WordPress TinyMCE Thumbnail Gallery Path Traversal Exposes Files

The TinyMCE Thumbnail Gallery plugin for WordPress contains a critical path traversal vulnerability affecting versions prior to 1.1.0. Security researchers identified that unauthenticated attackers can exploit this flaw to read arbitrary files on affected servers.

What happened

The vulnerability, tracked as CVE-2012-20002, exists in the TinyMCE Thumbnail Gallery plugin developed by James Charlesworth. According to the National Vulnerability Database, the issue stems from improper handling of the href parameter. Attackers can send GET requests to the /php/download-image.php script with traversal sequences.

These sequences allow unauthorized users to access files outside the intended directory structure. By appending patterns like ../../../../wp-config.php, attackers can retrieve sensitive configuration files. This includes database credentials and other system files that should remain protected from public access.

The flaw is rated as high severity with a CVSS score of 8.7. It maps to CWE-22, which describes path traversal weaknesses. The Shadowserver Foundation reported observing exploitation evidence for this specific vulnerability on October 19, 2023. This indicates active scanning or exploitation attempts in the wild.

Why it matters

Environments running WordPress with the TinyMCE Thumbnail Gallery plugin before version 1.1.0 are directly exposed. The unauthenticated nature of the attack means no login credentials are required to exploit the flaw. This lowers the barrier for attackers significantly.

Access to wp-config.php is particularly dangerous as it often contains database passwords. Compromising these credentials can lead to full database takeover. System files retrieved through this method may also reveal server configuration details. This information can aid attackers in planning further intrusion attempts.

The fact that exploitation was observed by Shadowserver suggests the bug is not just theoretical. Teams must assume their environments are being scanned. The lack of authentication requirements makes automated scanning highly effective for threat actors.

What to watch

• Verify if the TinyMCE Thumbnail Gallery plugin is installed on any WordPress instances.
• Check the version number to ensure it is 1.1.0 or later.
• Monitor web server logs for requests to download-image.php with traversal sequences.
• Look for unusual GET requests containing multiple dot-slash patterns in query strings.
• Watch for access attempts to sensitive configuration files like wp-config.php.

Signals worth monitoring

Teams usually detect path traversal attempts by analyzing web server access logs for unusual query string patterns. Look for requests containing multiple directory traversal sequences like ../../ in parameters. Check for access attempts to sensitive configuration files that should not be publicly reachable. Monitor for high volumes of 200 OK responses to these specific endpoints, which may indicate successful file reads. Investigate any spikes in traffic to download scripts that accept file paths as input.

Background: CVSS score

CVSS provides a standardized vector for exploit difficulty and access requirements, not business value. A high score indicates an easy attack path, not necessarily significant damage. You must contextualize the score with your environment’s exposure, asset value, and compensating controls to determine true risk.

Read the full guide: CVSS Scores: Why High Numbers Mislead Your Risk Assessment

What to do and how to stay safe: WordPress

• Audit all WordPress installations to identify if the TinyMCE Thumbnail Gallery plugin is present.
• Update the plugin to version 1.1.0 or newer once the vendor provides an update.
• Review web server logs for historical evidence of exploitation attempts using traversal sequences.
• Restrict access to sensitive directories and configuration files using server-level rules.

General security guidance from the Firewall Chronicle newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which WordPress plugin is affected by CVE-2012-20002?

The TinyMCE Thumbnail Gallery plugin developed by James Charlesworth is affected.

What versions of the plugin are vulnerable?

Versions prior to 1.1.0 of the TinyMCE Thumbnail Gallery plugin are vulnerable.

What is the severity rating of this vulnerability?

The National Vulnerability Database rates the severity as high with a CVSS score of 8.7.