CVE-2026-77193: eesy_ID2WP WordPress Plugin Path Traversal

CVE-2026-77193 Overview

The eesy_ID2WP – Publish InDesign HTML5 plugin for WordPress contains a path traversal vulnerability [CWE-22] affecting all versions up to and including 1.0.3. The flaw resides in the id2wp_path parameter, which fails to validate user-supplied input before accessing files on the server. Unauthenticated attackers can traverse directory boundaries to read arbitrary files, potentially exposing WordPress configuration files, database credentials, and other sensitive data. The vulnerability requires no authentication and can be exploited remotely over the network.

Critical Impact
Unauthenticated remote attackers can read arbitrary files from the WordPress server, including wp-config.php containing database credentials and secret keys.

Affected Products

eesy_ID2WP – Publish InDesign HTML5 plugin for WordPress
All versions up to and including 1.0.3
WordPress installations with the vulnerable plugin enabled

Discovery Timeline

2026-09-24 - CVE-2026-77193 published to NVD
2026-09-24 - Last updated in NVD database

Technical Details for CVE-2026-77193

Vulnerability Analysis

The eesy_ID2WP plugin accepts a filesystem path through the id2wp_path request parameter without sanitizing directory traversal sequences. An attacker can supply sequences such as ../ to escape the plugin's intended working directory and reach arbitrary locations on the host filesystem. The server then returns the file contents in the HTTP response, enabling direct exfiltration of sensitive data.

Because the endpoint is reachable without authentication, exploitation requires only HTTP access to the WordPress site. Attackers commonly target wp-config.php to recover database credentials, AUTH_KEY values, and salts. Additional targets include /etc/passwd, SSH keys, and application log files that may contain session tokens.

Root Cause

The root cause is missing input validation on the id2wp_path parameter. The plugin passes attacker-controlled input directly into a file-read operation without canonicalization or allowlist enforcement. This classifies as CWE-22: Improper Limitation of a Pathname to a Restricted Directory.

Attack Vector

Exploitation occurs over the network against the plugin endpoint that processes id2wp_path. The attacker issues an HTTP request supplying a traversal payload that resolves outside the plugin's intended directory. See the Wordfence Vulnerability Report for additional technical context.

Detection Methods for CVE-2026-77193

Indicators of Compromise

HTTP requests containing the id2wp_path parameter with directory traversal sequences such as ../, ..%2f, or encoded variants
Access log entries referencing plugin endpoints followed by requests for sensitive files like wp-config.php or /etc/passwd
Unexpected outbound reads of WordPress configuration files from the web server process
Spikes in 200-status responses to plugin paths from unauthenticated clients

Detection Strategies

Deploy web application firewall (WAF) rules that block traversal patterns in query and POST parameters targeting the plugin
Review WordPress plugin inventory to identify installations of eesy_ID2WP at version 1.0.3 or earlier
Correlate HTTP access logs with file integrity monitoring events on sensitive configuration files
Hunt for the string id2wp_path combined with .. sequences across historical web server logs

Monitoring Recommendations

Enable verbose HTTP request logging including full query strings for the WordPress site
Alert on any read access to wp-config.php originating from the web server user outside of normal application startup
Monitor for post-exploitation activity such as database connections from unfamiliar hosts using known credentials

How to Mitigate CVE-2026-77193

Immediate Actions Required

Disable or remove the eesy_ID2WP plugin until a patched release is confirmed and installed
Rotate all WordPress secrets in wp-config.php including AUTH_KEY, SECURE_AUTH_KEY, LOGGED_IN_KEY, NONCE_KEY, and database credentials
Audit web server logs for prior exploitation attempts referencing the id2wp_path parameter
Restrict access to the WordPress admin and plugin endpoints to trusted IP ranges where feasible

Patch Information

A code change addressing the issue is referenced in the WordPress Plugin Changeset. Administrators should upgrade to the latest available version of the eesy_ID2WP plugin that incorporates this changeset. Confirm the installed version post-upgrade through the WordPress admin plugin management interface.

Workarounds

Remove the plugin entirely if a patched version is not yet deployed in your environment
Deploy WAF signatures that reject requests containing traversal sequences in the id2wp_path parameter
Apply filesystem permissions that prevent the web server user from reading files outside the WordPress document root
Use open_basedir restrictions in PHP to constrain file read operations to the WordPress installation directory

bash

# PHP open_basedir restriction example in php.ini
open_basedir = "/var/www/html/:/tmp/"

# Example ModSecurity rule to block traversal in id2wp_path
SecRule ARGS:id2wp_path "@rx (\.\./|\.\.%2f|%2e%2e/)" \
    "id:1000001,phase:2,deny,status:403,msg:'Path traversal attempt in id2wp_path'"