cve/cves/2012/CVE-2012-20002.md

### [CVE-2012-20002](https://www.cve.org/CVERecord?id=CVE-2012-20002)
**TinyMCE Thumbnail Gallery WordPress Plugin < 1.1.0 Path Traversal via download-image.php**
![](https://img.shields.io/static/v1?label=Vendor&message=James%20Charlesworth&color=blue)
![](https://img.shields.io/static/v1?label=Product&message=TinyMCE%20Thumbnail%20Gallery&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=0.10&color=brightgreen)
![](https://img.shields.io/static/v1?label=Vulnerability&message=Improper%20Limitation%20of%20a%20Pathname%20to%20a%20Restricted%20Directory%20%28%27Path%20Traversal%27%29&color=brightgreen)

### Description

TinyMCE Thumbnail Gallery plugin for WordPress before 1.1.0 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files via the href parameter. Attackers can send GET requests to /php/download-image.php with traversal sequences like ../../../../wp-config.php to retrieve database credentials and system files. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-19.

### POC

#### Reference
- https://packetstorm.news/files/id/113417/
- https://www.exploit-db.com/exploits/19022

#### Github
No PoCs found on GitHub currently.