WordPress contains a flaw that allows a remote attacker to access arbitrary files outside of the web path. The issue is due to the /wp-admin/options.php script not properly sanitizing user input, specifically directory traversal style attacks (../../) supplied via the 'page' variable.
Classification
Location:
Remote / Network Access
Attack Type:
Input Manipulation
Impact:
Loss of Confidentiality,
Loss of Integrity
Exploit:
Exploit Public
Disclosure:
Uncoordinated Disclosure
OSVDB:
Web Related
