Recently we found that the plugin Download Plugin plugin contained an arbitrary directory download vulnerability. The Download Theme plugin is from the same developer and has very similar code, which leads to it having the same vulnerability. Other than the AJAX function and function it connects to being named differently, the only difference is that you don’t need to include a input for the value “f” as well as the directory when making the request to exploit this vulnerability.

Proof of Concept

The following proof of concept will ZIP up the website’s files and prompt you to download them.

Make sure to replace “[path to WordPress]” with the location of WordPress.

http://[path to WordPress]/wp-admin/admin-post.php?dtwap_download=../../

Timeline

• 7/7/2016 – Developer notified.
• 7/14/2016 – WordPress.org Plugin Directory notified.
• 7/14/2016 – Removed from WordPress.org Plugin Directory.
• 7/21/2016 – Version 1.0.3 released, which fixes vulnerability.

Concerned About The Security of The Plugins You Use?

When you are a paying customer of our service (you can currently try the service free for the first month), you get to suggest/vote on what plugins we will do security reviews of.