Rename <= 1.0 is vulnerable to Absolute Path Traversal

Unauthenticated

Published
2015-06-21

Absolute path traversal vulnerability in mysqldump_download.php in the WordPress Rename plugin 1.0 for WordPress allows remote attackers to read arbitrary files via a full pathname in the dumpfname parameter.

CVE

https://www.cve.org/CVERecord?id=CVE-2015-4703

CVSS

Score:7.5

Severity:High

Version: 1.0

There is a patch available in v1.1 and we strongly recommend you update to this version as soon as possible.