CVE-2018-25326: Google Drive WordPress Path Traversal Flaw

CVE-2018-25326 Overview

CVE-2018-25326 is a path traversal vulnerability [CWE-22] in the Google Drive for WordPress plugin version 2.2. The flaw resides in the gdrive-ajaxs.php endpoint, which accepts a file_name parameter without sanitizing directory traversal sequences. Unauthenticated attackers can send crafted POST requests with ajaxstype=del_fl_bkp and traversal sequences such as ../../wp-config.php in file_name to read arbitrary files on the underlying host. Successful exploitation exposes WordPress configuration files containing database credentials, authentication keys, and salts.

Critical Impact

Unauthenticated attackers can read sensitive files including wp-config.php, leading to full WordPress site compromise through stolen database credentials and secret keys.

Affected Products

• Google Drive for WordPress plugin version 2.2
• WordPress installations with the vulnerable plugin enabled
• Any web host serving the gdrive-ajaxs.php endpoint

Discovery Timeline

• 2026-05-17 - CVE-2018-25326 published to NVD
• 2026-05-18 - Last updated in NVD database

Technical Details for CVE-2018-25326

Vulnerability Analysis

The vulnerability stems from missing input validation in the gdrive-ajaxs.php AJAX handler. When the plugin processes a request with ajaxstype set to del_fl_bkp, it passes the file_name parameter directly to file system operations. The handler does not normalize the path or restrict access to the plugin's working directory. Attackers can traverse upward in the directory structure using ../ sequences and target arbitrary files readable by the web server process.

The endpoint is reachable without authentication, which removes the typical access control barrier present in administrative WordPress functionality. This combination of unauthenticated access and unvalidated path input yields a high-impact information disclosure primitive against any site running the affected plugin.

Root Cause

The root cause is improper limitation of a pathname to a restricted directory [CWE-22]. The plugin trusts user-supplied input for filesystem operations and lacks both canonicalization and an allowlist check against the intended backup directory.

Attack Vector

Exploitation requires only a single HTTP POST request to gdrive-ajaxs.php. The attacker supplies ajaxstype=del_fl_bkp and a file_name value containing relative path traversal sequences pointing to a target file such as ../../wp-config.php. No credentials, user interaction, or prior site access are required. Public proof-of-concept code is referenced in Exploit-DB #44435 and the VulnCheck advisory.

Detection Methods for CVE-2018-25326

Indicators of Compromise

• POST requests to /wp-content/plugins/*/gdrive-ajaxs.php containing ../ sequences in the file_name parameter
• Web server access logs showing ajaxstype=del_fl_bkp paired with sensitive filenames such as wp-config.php, .htaccess, or /etc/passwd
• Unexpected outbound activity from the WordPress host following access to the vulnerable endpoint
• Unauthenticated requests from unknown IP addresses targeting plugin AJAX handlers

Detection Strategies

• Inspect HTTP request bodies and query parameters for path traversal patterns including ../, ..%2f, and double-encoded variants
• Alert on any access to gdrive-ajaxs.php from non-administrative sources
• Correlate file read operations against wp-config.php with preceding HTTP traffic to the plugin
• Apply WordPress plugin inventory scans to identify installations of Google Drive for WordPress 2.2

Monitoring Recommendations

• Forward web server and WordPress access logs to a centralized analytics platform for traversal pattern matching
• Monitor filesystem access on wp-config.php and other secrets, alerting on reads by the web server user outside expected times
• Track new outbound database connections from the WordPress host using stolen credentials

How to Mitigate CVE-2018-25326

Immediate Actions Required

• Disable or remove the Google Drive for WordPress plugin until a patched version is confirmed installed
• Rotate all secrets in wp-config.php including database credentials, AUTH_KEY, SECURE_AUTH_KEY, LOGGED_IN_KEY, and NONCE_KEY
• Audit web server logs for prior exploitation against gdrive-ajaxs.php
• Reset WordPress administrator passwords and review user accounts for unauthorized additions

Patch Information

No vendor patch is referenced in the available advisory data. Review the VulnCheck advisory and the Exploit-DB entry for current vendor guidance. If no updated plugin version is available, removal is the recommended path.

Workarounds

• Block external access to gdrive-ajaxs.php at the web server or WAF layer
• Deploy a web application firewall rule that rejects requests containing ../ or URL-encoded traversal sequences in POST bodies
• Restrict filesystem permissions so the web server user cannot read sensitive files outside the WordPress document root where feasible
• Place WordPress behind authenticated reverse proxy controls for administrative endpoints

# Example nginx rule to block traversal patterns against the vulnerable endpoint
location ~* /gdrive-ajaxs\.php$ {
    if ($request_body ~* "\.\./") {
        return 403;
    }
    if ($args ~* "\.\./") {
        return 403;
    }
    # Optionally deny all access until plugin is removed
    deny all;
}