CVE-2015-20124: Aspose WordPress Path Traversal Flaw

CVE-2015-20124 Overview

CVE-2015-20124 is a path traversal vulnerability [CWE-22] in the Aspose Importer & Exporter plugin for WordPress before version 3.0. The flaw resides in aspose_import_export_download.php, which accepts a file parameter without sanitization. Unauthenticated attackers can send crafted GET requests containing directory traversal sequences to read arbitrary files from the WordPress host. A typical attack targets wp-config.php to extract database credentials and WordPress authentication secrets. The Shadowserver Foundation first observed exploitation activity against this plugin on 2023-10-20.

Critical Impact
Unauthenticated remote attackers can read arbitrary files, including wp-config.php, exposing database credentials and WordPress secret keys.

Affected Products

Aspose Importer & Exporter plugin for WordPress, all versions prior to 3.0
WordPress sites that installed the plugin from the WordPress plugin directory
Any hosting environment where the vulnerable aspose_import_export_download.php script remains reachable

Discovery Timeline

2026-10-20 - CVE-2015-20124 published to the National Vulnerability Database (NVD)
2026-10-22 - Last updated in NVD database

Technical Details for CVE-2015-20124

Vulnerability Analysis

The Aspose Importer & Exporter plugin exposes an HTTP-accessible PHP script, aspose_import_export_download.php, that returns the contents of a file specified in the file query parameter. The script performs no validation, canonicalization, or allowlisting on the supplied path. As a result, an attacker can supply traversal sequences such as ../../../wp-config.php to escape the intended download directory and read any file the web server process can access.

Successful exploitation discloses sensitive data including database credentials, WordPress AUTH_KEY and SECRET_KEY values, and system configuration files like /etc/passwd. Credentials pulled from wp-config.php frequently enable attackers to pivot to full site compromise through direct database access or administrator session forgery. The vulnerability requires no authentication and no user interaction.

Root Cause

The root cause is missing input validation on a user-controlled file path parameter, mapped to [CWE-22] (Improper Limitation of a Pathname to a Restricted Directory). The script passes the attacker-supplied file value directly to file read operations without stripping ../ sequences, enforcing a base directory, or validating against an allowlist of permitted files.

Attack Vector

The attack is delivered over the network via unauthenticated HTTP GET requests to the plugin's download endpoint. An attacker issues a request such as GET /wp-content/plugins/aspose-importer-exporter/aspose_import_export_download.php?file=../../../wp-config.php, and the server returns the raw contents of the targeted file. The exploitation pattern is documented in the public Nuclei template for aspose-ie-file-download and the Packet Storm advisory.

Detection Methods for CVE-2015-20124

Indicators of Compromise

HTTP requests to aspose_import_export_download.php containing ../ or URL-encoded %2e%2e%2f sequences in the file parameter
GET requests referencing sensitive filenames such as wp-config.php, .htaccess, or /etc/passwd in query strings
Unexpected outbound connections from the WordPress host following suspicious download requests, indicating credential reuse
Web server access logs showing 200 responses to the download script from unknown source IPs

Detection Strategies

Deploy the public Nuclei template to identify vulnerable installations across your estate
Create web application firewall rules that flag directory traversal patterns targeting the plugin path
Correlate access log entries for the plugin endpoint with subsequent authentication anomalies on the database or WordPress admin panel

Monitoring Recommendations

Alert on any GET request to /wp-content/plugins/aspose-importer-exporter/ where the file parameter contains traversal metacharacters
Monitor for reads of wp-config.php and rotate database and WordPress salts if access is detected
Review historical web logs back to October 2023, when Shadowserver first reported in-the-wild probing, to identify prior compromise attempts

How to Mitigate CVE-2015-20124

Immediate Actions Required

Upgrade the Aspose Importer & Exporter plugin to version 3.0 or later; if no fixed version is confirmed in your environment, remove the plugin entirely
Delete the aspose_import_export_download.php file from the webroot until the plugin can be updated or replaced
Rotate WordPress database credentials, AUTH_KEY, SECURE_AUTH_KEY, LOGGED_IN_KEY, and NONCE_KEY values defined in wp-config.php
Audit WordPress administrator accounts and session tokens for signs of unauthorized access

Patch Information

According to the VulnCheck advisory, the issue is fixed in Aspose Importer & Exporter version 3.0. The plugin page is available at the WordPress plugin directory listing. Site operators should verify the installed version through the WordPress plugin management interface.

Workarounds

Block external access to aspose_import_export_download.php at the web server or reverse proxy layer
Apply a WAF rule that denies any request whose file parameter contains .., %2e%2e, or absolute path prefixes such as /etc/
Restrict the web server user's filesystem permissions so sensitive files outside the webroot cannot be read

bash

# Nginx: block requests to the vulnerable script
location ~* /wp-content/plugins/aspose-importer-exporter/aspose_import_export_download\.php$ {
    deny all;
    return 403;
}

# Apache (.htaccess): block the vulnerable endpoint
<Files "aspose_import_export_download.php">
    Require all denied
</Files>