CVE-2015-10136: GI-Media Library < 3.0 - Directory Traversal

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 3.0% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-07-19 · updated 2026-06-17
Weakness: CWE-22

Description

The GI-Media Library plugin for WordPress is vulnerable to Directory Traversal in versions before 3.0 via the 'fileid' parameter. This allows unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information.

Affected products

zishanj GI-Media Library: before 3.0 — fixed in 3.0

How to fix

Upgrade to a fixed version: zishanj GI-Media Library 3.0. Check the vendor advisory for mitigations.

References

http://wordpressa.quantika14.com/repository/index.php?id=24
https://github.com/espreto/wpsploit/blob/master/modules/auxiliary/scanner/http/wp_gimedia_library_file_read.rb
https://plugins.trac.wordpress.org/changeset/1132677
https://wordpress.org/plugins/gi-media-library/#developers
https://wpscan.com/vulnerability/7754
https://www.rapid7.com/db/modules/auxiliary/scanner/http/wp_gimedia_library_file_read/
https://www.wordfence.com/threat-intel/vulnerabilities/id/2f80c3b9-5148-42eb-9137-9c538184cda3?source=cve

Get alerted when CVE-2015-10136 or the next vulnerability affects your stack