CVE-2015-20123: Aspose Doc Exporter Path Traversal Flaw

CVE-2015-20123 Overview

CVE-2015-20123 is a path traversal vulnerability [CWE-22] in the Aspose Doc Exporter plugin for WordPress before version 2.0. The flaw resides in aspose_doc_exporter_download.php, which passes an unsanitized file parameter directly into PHP's readfile() function. Unauthenticated attackers can retrieve arbitrary files from the web server by supplying traversal sequences such as ../../../wp-config.php, exposing database credentials and other sensitive configuration data. The Shadowserver Foundation first observed exploitation evidence on 2023-10-23.

Critical Impact

Unauthenticated remote attackers can read arbitrary files from vulnerable WordPress installations, including wp-config.php, enabling database compromise and full site takeover.

Affected Products

• Aspose Doc Exporter plugin for WordPress versions prior to 2.0
• WordPress installations with the Aspose Doc Exporter plugin enabled
• Any PHP environment hosting the vulnerable aspose_doc_exporter_download.php script

Discovery Timeline

• 2026-10-20 - CVE-2015-20123 published to NVD
• 2026-10-22 - Last updated in NVD database

Technical Details for CVE-2015-20123

Vulnerability Analysis

The Aspose Doc Exporter plugin exposes an endpoint, aspose_doc_exporter_download.php, that accepts a file parameter via HTTP GET. The script passes the parameter value directly to PHP's readfile() function without validation, sanitization, or path normalization. An attacker can supply directory traversal sequences to escape the plugin's intended directory and read any file the web server process can access.

Because the endpoint requires no authentication, exploitation is trivial. A single GET request with a crafted file parameter returns the contents of the targeted file in the HTTP response body. The most impactful target is wp-config.php, which contains WordPress database credentials, authentication keys, and salts. Disclosure of these secrets enables direct database access and session forgery.

Root Cause

The vulnerability stems from missing input validation on a user-controlled file path. The plugin trusts the file query parameter and performs no checks for traversal patterns, no allowlist of permitted files, and no restriction to a base directory. This maps to CWE-22, Improper Limitation of a Pathname to a Restricted Directory.

Attack Vector

Exploitation requires only network access to the WordPress site. An attacker issues a GET request to the vulnerable script with the file parameter set to a relative path containing ../ sequences. For example, requesting aspose_doc_exporter_download.php?file=../../../wp-config.php returns the WordPress configuration file. Public exploit code is available through Exploit-DB entry 36559 and a Nuclei template maintained by ProjectDiscovery.

The vulnerability mechanism is documented in the VulnCheck Advisory for Aspose Plugin and the WPScan Vulnerability Report. No synthetic exploit code is reproduced here; refer to the Exploit-DB #36559 entry for the public proof of concept.

Detection Methods for CVE-2015-20123

Indicators of Compromise

• GET requests to aspose_doc_exporter_download.php containing a file parameter
• URL-encoded or plain traversal sequences such as ../, ..%2f, or %2e%2e%2f in query strings targeting the plugin
• Requests retrieving sensitive files such as wp-config.php, /etc/passwd, or .htaccess
• Unexpected outbound traffic from WordPress hosts following suspicious plugin access

Detection Strategies

• Review web server access logs for any requests to /wp-content/plugins/aspose-doc-exporter/aspose_doc_exporter_download.php
• Deploy the GitHub Nuclei Template to scan externally exposed WordPress sites
• Configure web application firewall rules to flag traversal patterns in query parameters
• Correlate plugin download endpoint access with subsequent authentication anomalies against the WordPress database

Monitoring Recommendations

• Alert on HTTP 200 responses from the plugin endpoint when the file parameter contains traversal characters
• Monitor file integrity on wp-config.php and track unexpected read patterns at the OS level
• Ingest WordPress and web server logs into a centralized analytics platform for retrospective hunting against the IOC set

How to Mitigate CVE-2015-20123

Immediate Actions Required

• Deactivate and remove the Aspose Doc Exporter plugin from all WordPress installations until a verified fix is confirmed
• Rotate all secrets stored in wp-config.php, including database credentials, authentication keys, and salts, if the plugin was ever exposed
• Audit WordPress user accounts and active sessions for signs of compromise following credential disclosure
• Block external access to aspose_doc_exporter_download.php at the web server or WAF layer

Patch Information

The plugin's official listing is maintained at WordPress Plugin: Aspose Doc Exporter. Versions prior to 2.0 are vulnerable. Administrators should verify the installed version, apply any vendor-released update to 2.0 or later, or remove the plugin if no maintained version is available. Review the VulnCheck Advisory for Aspose Plugin for current remediation guidance.

Workarounds

• Remove or rename aspose_doc_exporter_download.php to break the vulnerable code path
• Add a web server rewrite rule that returns HTTP 403 for any request to the plugin's download script
• Restrict read permissions on wp-config.php to the minimum required by the PHP process owner
• Deploy a WAF signature that blocks traversal sequences in the file query parameter

# Example nginx rule to block the vulnerable endpoint
location ~* /wp-content/plugins/aspose-doc-exporter/aspose_doc_exporter_download\.php$ {
    return 403;
}