TinyMCE Thumbnail Gallery WordPress plugin: Path traversal via download-image.php

Summary

The TinyMCE Thumbnail Gallery plugin for WordPress before version 1.1.0 contains a path traversal flaw in download-image.php. An unauthenticated attacker can send a GET request with traversal sequences in the href parameter to read arbitrary files on the web server. Files such as wp-config.php, which contains database credentials, can be retrieved if the plugin is installed and the file is reachable.

Affected

• TinyMCE Thumbnail Gallery plugin for WordPress, versions 0.10 to before 1.1.0 (according to the CVE record)
• Wordfence lists versions up to and including 1.0.7 as affected
• The lower bound could not be confirmed from a primary source

Fixed in

• Version 1.1.0 (WPScan, WordPress.org changeset 556394)

Workaround

Unknown.

• Restrict direct web access to php/download-image.php at the web server or WAF level, as a general hardening step if patching is delayed

Exploitation

• Public proof of concept: Exploit-DB 19022 (dated 2012-06-08)
• A Nuclei detection template exists
• The CVE text states exploitation was first observed by Shadowserver on 2023-10-19; this could not be verified
• KEV status conflicts between sources; verify in the CISA KEV catalogue
• CISA SSVC: exploitation status poc, automatable: yes

Our recommendation

• Inventory WordPress sites for this plugin and its version; any version below 1.1.0 is affected
• Update to version 1.1.0 or later, or remove the plugin if it is unused
• Review web server logs for requests to download-image.php; treat hits as possible credential exposure
• Rotate database credentials and salts in wp-config.php if such requests are found
• Check whether the plugin is still maintained before reuse

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Nuclei template wp-tinymce-lfi.yaml github.com
• WordPress.org plugin page wordpress.org
• WPScan vulnerability entry wpscan.com
• Exploit-DB 19022 www.exploit-db.com
• VulnCheck advisory www.vulncheck.com
• Wordfence threat intelligence entry www.wordfence.com
• NVD mirror (Vulners) vulners.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 01:27.