cve/2021/CVE-2021-39312.md

CVE-2021-39312

Description

The True Ranker plugin <= 2.2.2 for WordPress allows arbitrary files, including sensitive configuration files such as wp-config.php, to be accessed via the src parameter found in the ~/admin/vendor/datatables/examples/resources/examples.php file.

POC

Reference

• http://packetstormsecurity.com/files/165434/WordPress-The-True-Ranker-2.2.2-Arbitrary-File-Read.html

Github

• https://github.com/ARPSyndicate/cvemon
• https://github.com/ARPSyndicate/kenzer-templates
• https://github.com/Enes4xd/Enes4xd
• https://github.com/cr0ss2018/cr0ss2018
• https://github.com/ezelnur6327/Enes4xd
• https://github.com/ezelnur6327/ezelnur6327