WordPress Aspose PDF Exporter Local File Inclusion Scanner

WordPress Aspose PDF Exporter is a plugin used on WordPress CMS platforms across various industries for converting WordPress posts and pages into PDFs, ensuring ease of document sharing and storage. Maintained by a specific developer ecosystem, it is utilized by content managers, bloggers, and developers who need simple solutions for document format conversion. Its primary function is to allow users to export content directly from WordPress into a PDF document. The plugin integrates seamlessly into the WordPress environment, providing a user-friendly interface for non-technical users. Often used by small to medium enterprises, it plays a vital role in digital documentation processes.

The Local File Inclusion (LFI) vulnerability arises due to insufficient input validation and sanitization of user-supplied file paths. When the plugin processes requests to export content, it fails to properly restrict the file parameter to allowed directories. This allows an attacker to manipulate the file path using directory traversal sequences like '../' to include arbitrary files from the server's filesystem. The vulnerability is present in the plugin's core functionality that handles PDF generation.

Specifically, the vulnerable endpoint is located in the plugin's main script, where the 'file' parameter is passed directly to file inclusion functions without proper filtering. An attacker can craft a request such as 'http://target.com/wp-content/plugins/aspose-pdf-exporter/export.php?file=../../../../wp-config.php' to read sensitive configuration files. The parameter is not restricted to PDF-related files, enabling traversal to any readable file on the server.

If exploited, an attacker can read sensitive files including wp-config.php, which contains database credentials, salts, and other critical configuration data. This can lead to complete compromise of the WordPress site, including unauthorized access to the database, user accounts, and potentially the entire server. The CVSS score of 7.5 reflects the high impact on confidentiality and the ease of exploitation without authentication.