This host is running WordPress with wp-FileManager plugin and is prone to file download vulnerability.

Successful exploitation will allow remote attackers to download and read arbitrary files on the affected application. Impact Level: Application

Upgrade to version 1.4.0 or later, For updates refer to http://wordpress.org/extend/plugins/wp-filemanager

The input passed via 'path' parameter to 'wordpress/wp-content/plugins/wp-filemanager/incl/libfile.php' script is not properly validating '../'(dot dot) sequences before being returned to the user.

Wordpress wp-FileManager Plugin before 1.4.0

• http://security4you.net/blog/wordpress-wp-filemanager-local-file-download-vulnerability
• http://wordpress.org/extend/plugins/wp-filemanager/changelog
• http://www.securelist.com/en/advisories/53421

---

Updated on 2017-03-28