CVE-2015-5471

Severity: medium (CVSS 5.3 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 32.5% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2016-01-12 · updated 2026-06-17
Weakness: CWE-22

Description

Absolute path traversal vulnerability in include/user/download.php in the Swim Team plugin 1.44.10777 for WordPress allows remote attackers to read arbitrary files via a full pathname in the file parameter.

Affected products

Swim Team Project Swim Team: 1.44.10777

References

http://michaelwalsh.org/blog/2015/07/wp-swimteam-v1-45-beta-3-now-available/
http://packetstormsecurity.com/files/132653/WordPress-WP-SwimTeam-1.44.10777-Arbitrary-File-Download.html
http://www.securityfocus.com/bid/75600
http://www.vapid.dhs.org/advisory.php?v=134
https://wordpress.org/support/topic/security-vulnerability-6
https://wpvulndb.com/vulnerabilities/8071
http://michaelwalsh.org/blog/2015/07/wp-swimteam-v1-45-beta-3-now-available/
http://packetstormsecurity.com/files/132653/WordPress-WP-SwimTeam-1.44.10777-Arbitrary-File-Download.html
http://www.securityfocus.com/bid/75600
http://www.vapid.dhs.org/advisory.php?v=134
https://wordpress.org/support/topic/security-vulnerability-6
https://wpvulndb.com/vulnerabilities/8071

Get alerted when CVE-2015-5471 or the next vulnerability affects your stack