CVE-2021-39312

True Ranker <= 2.2.2 Directory Traversal/Arbitrary File Read

CVSS 7.5 HIGHEPSS 78.4%CWE-22

The True Ranker plugin <= 2.2.2 for WordPress allows arbitrary files, including sensitive configuration files such as wp-config.php, to be accessed via the src parameter found in the ~/admin/vendor/datatables/examples/resources/examples.php file.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Affected products

True Ranker · True Ranker

public PoCs found — 2

cve_referencepacketstormsecurity.com/files/165434/WordPress-The-True-Ranker-2.2.2-Arbitrary-File-Read.htmlunverified exploitdbwww.exploit-db.com/exploits/50624unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

http://packetstormsecurity.com/files/165434/WordPress-The-True-Ranker-2.2.2-Arbitrary-File-Read.html https://plugins.trac.wordpress.org/browser/seo-local-rank/tags/2.2.2/admin/vendor/datatables/examples/resources/examples.php https://www.wordfence.com/vulnerability-advisories/#CVE-2021-39312