CVE-2015-4694

Directory traversal vulnerability in download.php in the Zip Attachments plugin before 1.5.1 for WordPress allows remote attackers to read arbitrary files via a .. dot dot in the zafile parameter...

Directory traversal

Directory traversal vulnerability in download.php in the Zip Attachments plugin before 1.5.1 for WordPress allows remote attackers to read arbitrary files via a .. dot dot in the zafile parameter...

CVE-2015-4694

Directory traversal vulnerability in download.php in the Zip Attachments plugin before 1.5.1 for WordPress allows remote attackers to read arbitrary files via a .. dot dot in the zafile parameter...

CVE-2015-4694

CVE-2015-4694 affects the WordPress Zip Attachments plugin (versions before 1.5.1). A directory traversal flaw in download.php (za_file parameter) allows an attacker to read arbitrary files. Public references describe this as an arbitrary file retrieval/vulnerability in the plugin. Remediation: u...

Download Zip Attachments 1.0 File Download

Title: Remote file download vulnerability in download-zip-attachments v1.0 Author: Larry W. Cashdollar, @larry0 Date: 2015-06-10 Download Site: https://wordpress.org/plugins/download-zip-attachments/ Vendor: rivenvirus Vendor Notified: 2015-06-15 Vendor Contact:...

WordPress Zip Attachments Plugin Arbitrary File Download Vulnerability

WordPress is a blogging platform developed using the PHP language, which supports personal blog sites on servers with PHP and MySQL. An arbitrary file download vulnerability exists in the WordPress Zip Attachments plugin, which allows remote attackers to exploit the vulnerability by submitting a...

WordPress Zip Attachments Plugin <= 1.5.0 - Directory Traversal

This vulnerability allows an attacker to read arbitrary files in the "zafile" parameter. Solution Update the plugin...

Zip Attachments <= 1.1.4 - Arbitrary File Download

The zip-attachments plugin allows arbitrary file downloads because it does not check the download path of the requested file. http://www.example.com/wp-content/plugins/zip-attachments/download.php?zafile=../../../../../etc/passwd&zafilename=passwd...

Zip Attachments <= 1.1.4 - Arbitrary File Download

The zip-attachments plugin allows arbitrary file downloads because it does not check the download path of the requested file. PoC http://www.example.com/wp-content/plugins/zip-attachments/download.php?zafile=../../../../../etc/passwdfilename=passwd...