Eesy Id2Wp Publish Indesign Html5
Monthly
Unauthenticated path traversal in the eesy_ID2WP - Publish InDesign HTML5 WordPress plugin lets any remote attacker read arbitrary files from the host server on any site running version 1.0.3 or earlier. The flaw is reached through the id2wp_path parameter and requires no authentication, no privileges, and no user interaction (CVSS 3.1 AV:N/AC:L/PR:N/UI:N, 7.5 HIGH), with impact limited to confidentiality because the attacker can only retrieve files the web server process itself is permitted to read. No public exploit code has been identified at time of analysis and there is no confirmed actively exploited (CISA KEV) status; the practical risk is opportunistic scanning of WordPress sites that have this niche plugin installed and active.
Unauthenticated path traversal in the eesy_ID2WP - Publish InDesign HTML5 WordPress plugin lets any remote attacker read arbitrary files from the host server on any site running version 1.0.3 or earlier. The flaw is reached through the id2wp_path parameter and requires no authentication, no privileges, and no user interaction (CVSS 3.1 AV:N/AC:L/PR:N/UI:N, 7.5 HIGH), with impact limited to confidentiality because the attacker can only retrieve files the web server process itself is permitted to read. No public exploit code has been identified at time of analysis and there is no confirmed actively exploited (CISA KEV) status; the practical risk is opportunistic scanning of WordPress sites that have this niche plugin installed and active.