PT-2015-7577 · WordPress · Wordpress Font Plugin

Published 2015-10-16 · Updated 2018-10-09 · CVE-2015-7683

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions WordPress Font plugin versions prior to 7.5.1

Description The issue allows remote administrators to read arbitrary files due to an absolute path traversal vulnerability in the Font.php file of the Font plugin for WordPress. This can be achieved by providing a full pathname in the url parameter to the "AjaxProxy.php" endpoint.

Recommendations For WordPress Font plugin versions prior to 7.5.1, update to version 7.5.1 or later to resolve the issue.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2015-7683

Affected Products

Wordpress Font Plugin

References · 6

• 🔥 http://packetstormsecurity.com/files/133930/WordPress-Font-7.5-Path-Traversal.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2015-7683 · Security Note
• https://wordpress.org/plugins/font/changelog · Patch
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7683 · Note
• http://securityfocus.com/archive/1/536670/100/0/threaded · Note
• https://wpvulndb.com/vulnerabilities/8214 · Note