Aspose Importer & Exporter WordPress plugin: Path Traversal in file download

Summary

The Aspose Importer & Exporter plugin for WordPress before version 3.0 contains a Path Traversal vulnerability in the aspose_import_export_download.php endpoint. An unauthenticated remote attacker can send crafted GET requests with traversal sequences in the 'file' parameter to download arbitrary files from the server. A demonstrated target is wp-config.php, which contains database credentials and can lead to full compromise of the WordPress site.

Affected

• Aspose Importer & Exporter WordPress plugin, versions 1.0 to before 3.0
• Unknown whether the plugin is still maintained; a Patchstack entry lists a discontinued plugin version 2.0 or lower

Fixed in

• Version 3.0 (according to OpenCVE and VulDB)
• Availability of version 3.0 on wordpress.org has not been verified

Workaround

• Unknown. No vendor-published workaround found.
• If the plugin cannot be updated to 3.0, remove it.

Exploitation

• Public proof-of-concept code: a ProjectDiscovery Nuclei template exists and Packet Storm lists an exploit entry.
• VulnCheck lists the vulnerability as exploited (Observed) in its KEV catalog.
• CISA KEV status is unconfirmed.
• The CISA SSVC assessment lists exploitation as PoC and the flaw as automatable.
• Shadowserver first-observation date (2023-10-20) conflicts with the publication date (2026-10-20) and is unverified.
• EPSS is low (0.00389).

Our recommendation

• Identify all WordPress sites with the Aspose Importer & Exporter plugin and check the installed version.
• Update to version 3.0 or later if available; otherwise remove the plugin.
• Prioritise internet-facing sites because no login is required.
• If the plugin was exposed, rotate database credentials and review web server logs for requests to aspose_import_export_download.php with traversal sequences.
• Verify the NVD status and the release history on wordpress.org.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Nuclei template aspose-ie-file-download.yaml github.com
• VulnCheck advisory www.vulncheck.com
• WordPress plugin directory: Aspose Importer & Exporter wordpress.org
• OpenCVE CVE-2015-20124 app.opencve.io
• VulDB 423015 vuldb.com
• Exploit-intel CVE-2015-20124 exploit-intel.com
• Packet Storm 131162 packetstorm.news

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 01:24.