Aspose Doc Exporter WordPress plugin: Path traversal leads to arbitrary file read
Summary
The Aspose Doc Exporter plugin for WordPress before version 2.0 does not sanitize the file parameter of its download script aspose_doc_exporter_download.php. An unauthenticated attacker can send a single GET request with a path such as ../../../wp-config.php to read arbitrary files from the web server. Reading wp-config.php exposes the WordPress database credentials, which can lead to full site compromise or data theft. A public proof of concept has existed since 2015, and the plugin is no longer maintained, so affected sites may not receive a fix.
Affected
- Aspose Doc Exporter plugin for WordPress, versions 1.0 to before 2.0
- Default configuration: the plugin is unaffected unless installed in a vulnerable version
Fixed in
- Version 2.0 (according to WPScan and VulnCheck)
- Unverified: the WordPress.org listing is closed and no official 2.0 download could be confirmed. No Aspose security advisory was found.
Workaround
- No vendor-documented workaround.
- Deactivate and delete the plugin and its directory; a version upgrade alone is not sufficient.
Exploitation
- Public proof of concept: yes (Exploit-DB 36559, dated 2015-03-30, targets version 1.0).
- Nuclei detection template available.
- CISA SSVC: exploitation status 'poc', automatable: yes, technical impact: partial.
- In-the-wild exploitation: conflicting or unverified. The supplied description cites Shadowserver observations from 2023-10-23, which could not be confirmed. Other sources list the CVE as not known exploited.
Our recommendation
- Check all WordPress sites, including staging and forgotten installs, for the plugin.
- Deactivate and delete the plugin; do not rely on an update alone, because the plugin is unmaintained and 2.0 may not be obtainable.
- If the vulnerable version was reachable, rotate the database password and the WordPress authentication keys and salts.
- Review web server logs for requests to aspose_doc_exporter_download.php with a 'file' parameter containing '../'.
- Do not use forks as a patch unless their fix has been verified.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- NVD/Nuclei template: aspose-words-file-download.yaml github.com
- WordPress.org plugin page: Aspose Doc Exporter wordpress.org
- WPScan vulnerability advisory wpscan.com
- Exploit-DB 36559 www.exploit-db.com
- VulnCheck advisory: Aspose Doc Exporter path traversal www.vulncheck.com
- VulDB entry 423014 vuldb.com
- Vulners NVD record CVE-2015-20123 vulners.com
- Packet Storm entry 131167 packetstorm.news
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 01:27.
Original description (NVD)
Aspose Doc Exporter plugin for WordPress before 2.0 contains a path traversal vulnerability that allows unauthenticated attackers to download arbitrary files by passing unsanitized paths to readfile(). Attackers can send GET requests to aspose_doc_exporter_download.php with the 'file' parameter set to values like ../../../wp-config.php to retrieve database credentials. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-23.
NVD references (6)
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/vulnerabilities/wordpress/aspose-words-fi…
- https://packetstorm.news/files/id/131167/
- https://wordpress.org/plugins/aspose-doc-exporter/
- https://wpscan.com/vulnerability/043aa583-a81d-4565-bf65-83252b8f1f96
- https://www.exploit-db.com/exploits/36559
- https://www.vulncheck.com/advisories/aspose-doc-exporter-wordpress-plugin-2.0-path-traversal-via-aspose-doc-e…
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.