high7.5Public exploit code
CVE-2021-39312
The True Ranker plugin <= 2.2.2 for WordPress allows arbitrary files, including sensitive configuration files such as wp-config.php, to be accessed via the src…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- WordPress Plugin The True Ranker 2.2.2 - Arbitrary File Read (Unauthenticated)2022-01-05 · webapps · php
Impact
The True Ranker plugin <= 2.2.2 for WordPress allows arbitrary files, including sensitive configuration files such as wp-config.php, to be accessed via the src parameter found in the ~/admin/vendor/datatables/examples/resources/examples.php file.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Trueranker | True Ranker | through 2.2.2 |
Weakness classification
References
- NVD record
- CVE.org record
- http://packetstormsecurity.com/files/165434/WordPress-The-True-Ranker-2.2.2-Arbitrary-File-Read.html
- https://plugins.trac.wordpress.org/browser/seo-local-rank/tags/2.2.2/admin/vendor/datatables/examples/resources/examples.php
- https://www.wordfence.com/vulnerability-advisories/#CVE-2021-39312
- http://packetstormsecurity.com/files/165434/WordPress-The-True-Ranker-2.2.2-Arbitrary-File-Read.html
- https://plugins.trac.wordpress.org/browser/seo-local-rank/tags/2.2.2/admin/vendor/datatables/examples/resources/examples.php
- https://www.wordfence.com/vulnerability-advisories/#CVE-2021-39312