Description

The eesy_ID2WP – Publish InDesign HTML5 plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.0.3 via the `id2wp_path` parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-09-24T09:17:07.877Z",
  "pubdate": "2026-09-24T09:17:07.877Z",
  "executiveSummary": "The eesy_ID2WP – Publish InDesign HTML5 plugin for WordPress, in all versions up to and including 1.0.3, contains a critical path traversal vulnerability.\nThis security flaw allows unauthenticated remote attackers to bypass file system access controls and read arbitrary files residing on the host server.\nThe vulnerability stems from improper neutralization of user-supplied input within the id2wp_path parameter, which is processed by the application without sufficient validation or sanitization.\nSuccessful exploitation grants an attacker the capability to access sensitive configuration files, system credentials, or application source code, potentially leading to a complete compromise of the WordPress installation.\nAs this vulnerability is accessible without authentication, it represents a high-risk vector for unauthorized information disclosure. There are no known exploitation prerequisites other than network connectivity to the affected WordPress instance and the ability to reach the vulnerable endpoint.\nThe risk implication is severe, as exposed files often include database credentials (wp-config.php), environment variables, and other proprietary data that facilitate further escalation or data exfiltration.",
  "technicalDetails": "The root cause of the vulnerability is the insecure handling of the id2wp_path parameter within the eesy_ID2WP plugin. The application fails to implement adequate input validation, such as path canonicalization or character filtering, before using the parameter to perform file system operations.\nPath traversal, also known as directory traversal, occurs when an application accepts user-supplied input to specify a file path without verifying that the requested resource resides within the intended directory structure.\nBy injecting directory traversal sequences—most commonly sequences of '../'—an attacker can escape the web root directory and navigate to arbitrary locations within the server's file system, subject only to the permissions of the web server process user (e.g., www-data).\nThe attack flow proceeds as follows: An attacker sends an HTTP request (GET or POST) containing a crafted id2wp_path parameter. For example, by supplying a payload such as '/../../../../etc/passwd', the attacker instructs the plugin to access system files outside the designated operational directory. Because the application processes this path directly, it reads the content of the target file and serves it back to the client in the HTTP response.\nThis vulnerability is present in the server-side code component responsible for handling the id2wp_path parameter. All versions of the eesy_ID2WP plugin up to and including 1.0.3 are confirmed to be vulnerable.\nExploitation requires no authentication or special privileges, making the vulnerability particularly dangerous in a public-facing WordPress environment. The attack is fully reachable via standard network exposure.\nThe post-exploitation impact includes the acquisition of sensitive information, such as WordPress configuration files containing database credentials, API keys, and secret salts. With access to these artifacts, an attacker can further refine their attack, potentially moving from arbitrary file read to database manipulation, remote code execution, or administrative account takeover."
}