blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

← Back to CVE list

CVE-2019-1010257

CRITICAL 9.1 CVSS 3.1
Published
March 27, 2019
Last modified
June 17, 2026
NVD status
Modified
Reported by
josh@bress.net
Weakness
CWE-22
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Description

An Information Disclosure / Data Modification issue exists in article2pdf_getfile.php in the article2pdf Wordpress plugin 0.24, 0.25, 0.26, 0.27. A URL can be constructed which allows overriding the PDF file's path leading to any PDF whose path is known and which is readable to the web server can be downloaded. The file will be deleted after download if the web server has permission to do so. For PHP versions before 5.3, any file can be read by null terminating the string left of the file extension.

Affected WordPress components

A confirmed match is backed by the plugin or theme slug. A possible match is based on the product name only and should be verified.

Affected products and versions

  • article2pdf article2pdf Wordpress plug-in — Version 0.24
  • article2pdf article2pdf Wordpress plug-in — Version 0.25
  • article2pdf article2pdf Wordpress plug-in — Version 0.26
  • article2pdf article2pdf Wordpress plug-in — Version 0.27
  • article2pdf_project article2pdf — From 0.24 (including) to 0.27 (including)

References

  • packetstormsecurity.com https://packetstormsecurity.com/files/152236/WordPress-article2pdf-0.24-DoS-File-Deletion-Disclosure.html Exploit, Third Party Advisory, VDB Entry
  • seclists.org https://seclists.org/bugtraq/2019/Mar/49 Exploit, Issue Tracking, Mailing List, Third Party Advisory
  • wordpress.org https://wordpress.org/support/topic/pdf-download-path-improperly-sanitised/ Third Party Advisory
  • wpvulndb.com https://wpvulndb.com/vulnerabilities/9246 Third Party Advisory
  • nvd.nist.gov Official NVD record