EUVD-2026-85815
GHSA-px6q-rh8c-fgq2
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify site running eesy_ID2WP plugin
-
DeliverySend request with traversal in id2wp_path
-
ExploitBypass directory restriction
-
ExecutionRead arbitrary server files (e.g. wp-config.php)
-
ImpactHarvest credentials and secrets
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Path canonicalization, traversal prevention
MITRE ATT&CK
2 techniques across 2 tactics: Discovery, Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions - remote unauthenticated exploitation against default installations of the eesy_ID2WP - Publish InDesign HTML5 WordPress plugin (all versions up to and including 1.0.3). Exploitation only requires that the plugin be installed and active on a reachable WordPress site; the attacker manipulates the id2wp_path parameter with directory-traversal sequences. The only meaningful limiting factor is deployment scope: the plugin is niche, and file-read is bounded by the web server's filesystem permissions (readable files only). Upgrading past 1.0.3 (fix in trac changeset 3662793) removes the condition. |
| Impact | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, 7.5 HIGH) describes a genuinely low-barrier flaw: network-reachable, low complexity, no privileges, no user interaction, yielding high confidentiality impact with no integrity or availability effect. All signals in this vector are internally consistent - a classic unauthenticated arbitrary-file-read path traversal, corroborated by CWE-22 and the description's explicit 'unauthenticated attackers to read the contents of arbitrary files.' However, several enrichment signals are ABSENT: no EPSS score is provided (exploitation probability cannot be quantified), the CVE is not listed in CISA KEV, and no public exploit code is referenced. The realistic priority is therefore moderated by prevalence: this is a niche WordPress plugin (InDesign-to-WordPress HTML5 publishing) with a small install base, so mass exploitation is unlikely despite the attractive unauthenticated file-read primitive. Net assessment: a real and easily-exploitable bug where it is installed, but low aggregate real-world risk driven by narrow deployment rather than by any weakness in the vulnerability itself. A patch exists (trac changeset 3662793), which lowers residual risk for maintained sites. |
| Exploit ScenarioDerived | An unauthenticated attacker sends a crafted HTTP request to the vulnerable plugin endpoint, supplying a traversal sequence (e.g. ../../) in the id2wp_path parameter to escape the intended directory and read arbitrary files such as wp-config.php, extracting database credentials and secret keys. No public exploit code is identified at time of analysis, but the low complexity and lack of authentication make weaponization trivial for any actor who locates the plugin. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 24, 2026
Unauthenticated path traversal in the eesy_ID2WP - Publish InDesign HTML5 WordPress plugin lets any remote attacker read arbitrary files from the host server on any site running version 1.0.3 or earlier. The flaw is reached through the id2wp_path parameter and requires no authentication, no privileges, and no user interaction (CVSS 3.1 AV:N/AC:L/PR:N/UI:N, 7.5 HIGH), with impact limited to confidentiality because the attacker can only retrieve files the web server process itself is permitted to read. No public exploit code has been identified at time of analysis and there is no confirmed actively exploited (CISA KEV) status; the practical risk is opportunistic scanning of WordPress sites that have this niche plugin installed and active.
RemediationAI
The primary fix is to move off the vulnerable code path by updating the plugin beyond version 1.0.3: the correcting change is WordPress.org plugin Trac changeset 3662793 (https://plugins.trac.wordpress.org/changeset/3662793/), and the official advisory should be consulted at https://www.wordfence.com/threat-intel/vulnerabilities/id/ad266e0f-fc69-4550-b89c-c32ce1221ee4?source=cve; note that patch status should be treated as an upstream fix available in the repository changeset, with a specifically tagged patched release not independently confirmed from the data provided, so verify the installed version after updating. If the plugin is not actively used to publish InDesign HTML5 content, the cleanest compensating control is to deactivate and remove it entirely, which eliminates the attack surface at the cost of losing the publishing workflow. Where the plugin must stay in place and no fixed version can be installed, restrict direct access to the plugin directory (for example denying requests to /wp-content/plugins/eesy-id2wp/ and any exposed endpoint handling id2wp_path) via web server or WAF rules - accepting that legitimate plugin requests may also be blocked if the rules are over-broad - and consider PHP open_basedir or similar filesystem confinement to shrink the set of files a traversal can reach, understanding that this may break other plugins that legitimately read outside the WordPress root. Because the read is limited to files readable by the web server user, tightening filesystem permissions on wp-config.php and other sensitive files reduces the value of a successful traversal but does not close the flaw.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is a classic CWE-22 improper limitation of a pathname to a restricted directory, occurring in a WordPress plugin whose purpose is to publish Adobe InDesign HTML5 exports onto a WordPress site. The plugin exposes the id2wp_path parameter to a file-access routine without canonicalizing the supplied value or verifying that the resolved path stays inside the plugin's intended content directory, so traversal sequences in that parameter cause the application to resolve and return files elsewhere on the filesystem. Because WordPress runs plugin code in the same process and with the same permissions as the rest of the site, the read is bounded only by the web server user's filesystem rights - typically wp-config.php, other plugins' source and data files, and any world-readable configuration or credential files, while paths restricted to root or other users remain inaccessible. The affected component is captured by the CPE cpe:2.3:a:eesywp:eesy_id2wp_-_publish_indesign_html5:*:*:*:*:*:*:*:*, indicating that every published version of the plugin is in scope rather than a single vulnerable build. The fix, published as WordPress.org plugin Trac changeset 3662793, addresses the missing path validation in the parameter handling.
Know when Wordpress Plugin gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Unauthenticated (PR:N) network (AV:N) request with no interaction reads arbitrary files, giving high confidentiality but no integrity or availability impact.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
DescriptionCVE.org
The eesy_ID2WP - Publish InDesign HTML5 plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.0.3 via the id2wp_path parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information.
Executive ViewAI
The WordPress plugin eesy_ID2WP - Publish InDesign HTML5 (versions 1.0.3 and earlier) contains a high-severity unauthenticated file-read flaw that allows any remote attacker to retrieve files from the web server hosting the site. Only organizations running this niche plugin are exposed, but for those that do, the confidentiality of configuration files and stored credentials is at risk. Because no vendor patch exists and exploitation requires no credentials or user interaction, leadership should treat any active installation as an urgent exposure to be removed while vendor remediation is awaited.
No vendor-released patch is available at time of analysis. Interim mitigations: deactivate and remove the eesy_ID2WP plugin (version 1.0.3 or earlier) from all WordPress sites; if removal is not immediately possible, block path traversal patterns targeting the id2wp_path parameter at the WAF or reverse proxy, restrict the web server process to least-privilege file read access, and monitor logs for encoded traversal attempts. Rotate any credentials or secrets stored in files the web server can read on affected hosts.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Path traversal exploits occur when applications use user-controlled input to construct file system paths without proper validation.
More in Wordpress Plugin
View allThe Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘hash’ parameter in
Remote code execution in the WP Query Console WordPress plugin (versions up to and including 1.0) by Ajit Bohra allows u
Exploit-DB