Javo Spot WordPress Theme: Path traversal allows reading arbitrary files

Summary

The Javo Spot WordPress theme before 3.0.0 contains a path traversal flaw in the jvfrm_spot_get_json AJAX action. An unauthenticated attacker can use the fn parameter to read arbitrary files readable by the web server, such as wp-config.php, which exposes database credentials and secret keys. Exploitation requires only a GET request to admin-ajax.php, and public proof-of-concept code and a Nuclei detection template exist.

Affected

• Javo Spot WordPress theme, all versions before 3.0.0

Fixed in

• Javo Spot 3.0.0 (according to WPScan and VulDB; no Javo Themes advisory found)

Workaround

• Disable the jvfrm_spot_get_json AJAX action via a code snippet described by the original researcher (not verified; test on staging first)
• Other mitigations such as WAF rules: Unknown.

Exploitation

• Exploitation evidence first observed by the Shadowserver Foundation on 2023-10-19.
• Public proof of concept and a Nuclei detection template are available.
• CISA SSVC: exploitation poc, automatable yes.
• Listing in CISA or VulnCheck KEV catalogs is conflicting in the sources: Unknown until verified.

Our recommendation

• Inventory WordPress sites for the Javo Spot theme and check the installed version.
• Update to 3.0.0 or later, or remove the theme if it is unused.
• If a site cannot be updated immediately, apply a tested workaround and restrict access to admin-ajax.php where possible.
• If a vulnerable site was exposed, rotate database credentials and WordPress salts and keys.
• Review web server logs for requests to admin-ajax.php with the jvfrm_spot_get_json action, particularly since 2023-10-19.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Original research post by codeseekah codeseekah.com
• WPScan vulnerability entry wpscan.com
• VulnCheck advisory www.vulncheck.com
• Nuclei detection template github.com
• ThemeForest product page themeforest.net

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 00:54.