Aspose PDF Exporter WordPress plugin: Path traversal leading to file download

Summary

The Aspose PDF Exporter plugin for WordPress before version 2.0 contains a path traversal flaw in aspose_pdf_exporter_download.php. The unsanitized 'file' parameter is passed to readfile(), so an unauthenticated remote attacker can read arbitrary files with a crafted GET request. Attackers can retrieve wp-config.php, which exposes WordPress database credentials and can lead to full site compromise. Exploitation has been reported in the wild, and the vendor has not published a security bulletin for this issue.

Affected

• Aspose PDF Exporter WordPress plugin, versions 1.0 to before 2.0
• Versions before 1.0 and the default configuration are not listed as affected by the CNA record.

Fixed in

• Version 2.0 (per VulnCheck and aggregator sources; the fix commit could not be verified directly)

Workaround

• No vendor-documented workaround.
• If the plugin cannot be updated, removing it is the only mitigation identified.

Exploitation

• Exploitation reported: the description states the Shadowserver Foundation first observed exploitation on 2023-10-19.
• VulnCheck KEV lists the CVE with exploitation observed.
• CISA KEV status unverified; one third-party source says no.
• A public Nuclei detection template exists, and Packet Storm lists an entry categorised as an exploit (content not reviewed).

Our recommendation

• Inventory all WordPress sites for the Aspose PDF Exporter plugin.
• Update to version 2.0 or remove the plugin.
• Rotate database credentials if a vulnerable plugin was exposed on a public site.
• Review web server logs for requests to aspose_pdf_exporter_download.php containing traversal sequences.
• Prioritise this on internet-facing WordPress sites, as exploitation is reported and the flaw is easy to scan for.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• VulnCheck advisory www.vulncheck.com
• Nuclei detection template github.com
• WordPress plugin page wordpress.org
• WPScan entry wpscan.com
• Fix changeset plugins.trac.wordpress.org
• Packet Storm entry packetstorm.news
• VulDB entry vuldb.com
• Exploit-intel record exploit-intel.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 01:24.