CVE-2015-10136
GI-Media Library < 3.0 - Directory Traversal
- State
- Published
- Severity
- 7.5 High
- Published
- Jul 19, 2025
- Updated
- Apr 8, 2026
- Reserved
- Jul 18, 2025
Description
The GI-Media Library plugin for WordPress is vulnerable to Directory Traversal in versions before 3.0 via the 'fileid' parameter. This allows unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 7.5 High | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N | Wordfence |
Weaknesses
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected Products
| Product | Versions |
|---|---|
GI-Media Libraryzishanj |
|
References
- https://www.wordfence.com/threat-intel/vulnerabilities/id/2f80c3b9-5148-42eb-9137-9c538184cda3?source=cve
- http://wordpressa.quantika14.com/repository/index.php?id=24
- https://github.com/espreto/wpsploit/blob/master/modules/auxiliary/scanner/http/wp_gimedia_library_file_read.rb
- https://wpscan.com/vulnerability/7754
- https://wordpress.org/plugins/gi-media-library/#developers
- https://plugins.trac.wordpress.org/changeset/1132677
- https://www.rapid7.com/db/modules/auxiliary/scanner/http/wp_gimedia_library_file_read/
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.