WordPress Cherry Plugin Path Traversal Allows Unauthenticated File Access
A high-severity flaw in the Cherry Plugin lets attackers download sensitive files like database credentials without logging in.
Key points
- CVE-2016-20103 affects Cherry Plugin versions prior to 1.2.7.
- The vulnerability is a path traversal issue rated 8.7 HIGH on the CVSS scale.
- Shadowserver Foundation observed exploitation attempts starting on October 19, 2023.
An unauthenticated path traversal vulnerability in the Cherry Plugin for WordPress allows attackers to download arbitrary files from the server. This flaw, tracked as CVE-2016-20103, exposes environments running versions older than 1.2.7 to potential data theft. Security teams should audit their WordPress installations immediately to identify if this plugin is present and outdated.
Root cause
The vulnerability stems from improper input validation in the plugin’s import-export functionality. Specifically, the script `download-content.php` passes user-supplied input directly to the `readfile()` function without sanitization. This design flaw maps to CWE-22, allowing directory traversal sequences to bypass intended file restrictions. According to the NVD record, the lack of checks enables attackers to traverse the directory structure and access files outside the designated folder.
Attack path
Attackers exploit this issue by sending GET requests to the `/admin/import-export/download-content.php` endpoint. They include traversal sequences, such as `../../../../../wp-config.php`, in the `file` parameter. This technique allows them to read sensitive configuration files, including database credentials. The Shadowserver Foundation first observed evidence of this exploitation on October 19, 2023, indicating that automated scanning or targeted attacks may have been occurring prior to that date.
Affected versions
- Cherry Plugin for WordPress versions before 1.2.7 are affected.
- Versions 1.2.7 and later are not affected by this specific path traversal issue.
Mitigation
- Update the Cherry Plugin to version 1.2.7 or later immediately.
- If updating is not possible, restrict access to the `/admin/import-export/` directory via web server configuration.
- Monitor web server logs for requests containing directory traversal sequences like `../`.
Detection notes
Security teams should review web server access logs for HTTP GET requests targeting the `download-content.php` file. Look for unusual query parameters containing multiple directory traversal sequences, which often indicate an attempt to read sensitive configuration files. Alert on any successful responses to these requests, especially if the requested file is not a standard media asset. Check whether the server returned large file sizes or specific content types associated with configuration files. Investigate any outbound connections that may result from stolen credentials.
What to do and how to stay safe: WordPress
- Inventory all installed WordPress plugins and verify their versions against known vulnerability databases.
- Configure web application firewalls to block requests containing directory traversal patterns in query parameters.
- Monitor server logs for unauthorized access attempts to administrative endpoints, particularly those handling file downloads.
- Once the vendor provides an update, apply it promptly to close the vulnerability window.
Step-by-step guide: Unpatched Software Myths: Why Common Beliefs Fail to Protect You
General security guidance from the BlueTeam Insider newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVSS score for CVE-2016-20103?
The CVSS score is 8.7, which is rated as HIGH severity.
Which specific file is vulnerable to path traversal?
The `/admin/import-export/download-content.php` script is vulnerable.
When was exploitation first observed?
The Shadowserver Foundation observed exploitation evidence on October 19, 2023.
