CVE-2016-20103: Cherry Plugin Path Traversal Vulnerability

CVE-2016-20103 Overview

CVE-2016-20103 is a path traversal vulnerability [CWE-22] in the Cherry Plugin for WordPress before version 1.2.7. The flaw resides in admin/import-export/download-content.php, which passes the user-supplied file parameter directly to PHP's readfile() function. Unauthenticated attackers can send a GET request containing directory traversal sequences to download arbitrary files from the web server. The Shadowserver Foundation first observed in-the-wild exploitation on 2023-10-19, with wp-config.php being a common target for extracting database credentials.

Critical Impact

Unauthenticated remote attackers can read arbitrary files, including wp-config.php, exposing database credentials and secret keys that enable full WordPress site compromise.

Affected Products

• Cherry Plugin for WordPress versions prior to 1.2.7
• WordPress sites using the CherryFramework cherry-plugin component
• Themes bundled with the vulnerable Cherry Plugin dependency

Discovery Timeline

• 2023-10-19 - Exploitation activity first observed by the Shadowserver Foundation
• 2026-10-20 - CVE-2016-20103 published to NVD
• 2026-10-22 - Last updated in NVD database

Technical Details for CVE-2016-20103

Vulnerability Analysis

The vulnerability exists in admin/import-export/download-content.php within the Cherry Plugin. The script reads the file GET parameter and passes it to file_exists() and readfile() without authentication checks, nonce verification, or path sanitization. Any HTTP client can request the endpoint and specify an arbitrary filesystem path.

Attackers typically target wp-config.php to recover DB_USER, DB_PASSWORD, and the AUTH_KEY constants. These values enable database-level access and session forgery against the WordPress installation.

Root Cause

The root cause is the absence of input validation and access control. The vulnerable handler accepts arbitrary input directly from $_GET["file"] and reads whatever path the attacker supplies. There is no capability check such as current_user_can(), no nonce verification through check_ajax_referer(), and no restriction to the WordPress uploads directory.

Attack Vector

Exploitation requires a single unauthenticated HTTP GET request to the vulnerable endpoint. Attackers append ../ sequences to traverse out of the plugin directory and read sensitive files such as wp-config.php, .htaccess, or /etc/passwd on misconfigured hosts.

Example exploitation request:

GET /wp-content/plugins/cherry-plugin/admin/import-export/download-content.php?file=../../../../../wp-config.php HTTP/1.1
Host: victim.example.com

The following patch from the vendor demonstrates the fix applied in version 1.2.7:

<?php
// If this file is called directly, abort.
if ( ! defined( 'ABSPATH' ) ) {
    die('Error');
}

/**
 * Process export file download
 */
function cherry_plugin_get_export_file() {

    check_ajax_referer( 'cherry_plugin_download_content', '_wpnonce' );

    if ( ! current_user_can( 'export' ) ) {
        wp_die( 'You do not have permissions to do this', 'Error' );
    }

    $file = isset($_GET["file"]) ? $_GET["file"] : '';

    if ( ! $file ) {
        wp_die( 'File not provided', 'Error' );
    }

    $upload_dir = wp_upload_dir();
    $upload_dir = $upload_dir['basedir'];

    if ( false === strpos( $file, $upload_dir ) && false === strpos( $file, str_replace( '\\', '/', $upload_dir ) ) ) {
        // reject files outside upload directory
    }

Source: CherryFramework patch commit 69a3f7b. The fix adds ABSPATH guard, nonce verification, capability check, and restricts reads to the WordPress uploads directory.

Detection Methods for CVE-2016-20103

Indicators of Compromise

• HTTP GET requests to /wp-content/plugins/cherry-plugin/admin/import-export/download-content.php containing a file parameter
• Request URIs containing ../ or URL-encoded %2e%2e%2f traversal sequences targeting the Cherry Plugin endpoint
• Access log entries where the file parameter references wp-config.php, .htaccess, or absolute paths outside the plugin directory
• Unexpected outbound database connections sourced from IP addresses that previously issued requests to the vulnerable endpoint

Detection Strategies

• Deploy the Nuclei template cherry-file-download.yaml against WordPress inventory to identify exposed instances.
• Create web application firewall rules that flag requests to download-content.php with path traversal sequences in the file parameter.
• Audit WordPress plugin inventories for CherryFramework cherry-plugin versions below 1.2.7 using the WPScan vulnerability database.

Monitoring Recommendations

• Alert on any HTTP 200 response for download-content.php requests where the file parameter contains traversal characters.
• Monitor for subsequent authentication anomalies on WordPress accounts after suspected wp-config.php disclosure.
• Review database audit logs for connections from unexpected source addresses following suspicious plugin requests.

How to Mitigate CVE-2016-20103

Immediate Actions Required

• Upgrade Cherry Plugin to version 1.2.7 or later on all WordPress installations.
• If the plugin is unmaintained within a theme, remove the cherry-plugin directory from wp-content/plugins/ and the parent theme.
• Rotate WordPress database credentials, AUTH_KEY, SECURE_AUTH_KEY, LOGGED_IN_KEY, and NONCE_KEY values if exploitation is suspected.
• Review access logs for historical requests to download-content.php and treat any 200 responses with traversal payloads as a compromise.

Patch Information

The fix was committed to the CherryFramework/cherry-plugin repository in commit 69a3f7b. The patch adds an ABSPATH guard, enforces check_ajax_referer() for nonce validation, requires the export capability via current_user_can(), and restricts file reads to the WordPress uploads directory returned by wp_upload_dir(). See the VulnCheck advisory for additional vendor details.

Workarounds

• Block external access to /wp-content/plugins/cherry-plugin/admin/import-export/download-content.php at the web server or WAF layer.
• Deny HTTP requests whose query strings contain ../ or encoded traversal sequences targeting the plugin path.
• Remove the vulnerable download-content.php file if the import/export feature is not required.

# nginx configuration to block the vulnerable endpoint
location ~* /wp-content/plugins/cherry-plugin/admin/import-export/download-content\.php$ {
    deny all;
    return 403;
}