CVE-2015-10136

Severity CVSS v4.0:

Pending analysis

Type:

CWE-22 Path Traversal

Publication date:

19/07/2025

Last modified:

22/07/2025

Description

The GI-Media Library plugin for WordPress is vulnerable to Directory Traversal in versions before 3.0 via the &#39;fileid&#39; parameter. This allows unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information.

Impact

Vector 3.x

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS v3.1 Severity and Metrics:

Base Score: 7.50 HIGH
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope (S): Unchanged
Confidentiality (C): High
Integrity (I): None
Availability (A): None

Base Score 3.x

7.50

Severity 3.x

HIGH

References to Advisories, Solutions, and Tools

http://wordpressa.quantika14.com/repository/index.php?id=24
https://github.com/espreto/wpsploit/blob/master/modules/auxiliary/scanner/http/wp_gimedia_library_file_read.rb
https://plugins.trac.wordpress.org/changeset/1132677
https://wordpress.org/plugins/gi-media-library/#developers
https://wpscan.com/vulnerability/7754
https://www.rapid7.com/db/modules/auxiliary/scanner/http/wp_gimedia_library_file_read/
https://www.wordfence.com/threat-intel/vulnerabilities/id/2f80c3b9-5148-42eb-9137-9c538184cda3?source=cve