CVE-2021-39312: True Ranker <= 2.2.2 Directory Traversal/Arbitrary File Read

Severity: medium (CVSS 5.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 77.9% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2021-12-14 · updated 2026-06-17
Weakness: CWE-22

Description

The True Ranker plugin <= 2.2.2 for WordPress allows arbitrary files, including sensitive configuration files such as wp-config.php, to be accessed via the src parameter found in the ~/admin/vendor/datatables/examples/resources/examples.php file.

Affected products

True Ranker: through 2.2.2

References

http://packetstormsecurity.com/files/165434/WordPress-The-True-Ranker-2.2.2-Arbitrary-File-Read.html
https://plugins.trac.wordpress.org/browser/seo-local-rank/tags/2.2.2/admin/vendor/datatables/examples/resources/examples.php
https://www.wordfence.com/vulnerability-advisories/#CVE-2021-39312
http://packetstormsecurity.com/files/165434/WordPress-The-True-Ranker-2.2.2-Arbitrary-File-Read.html
https://plugins.trac.wordpress.org/browser/seo-local-rank/tags/2.2.2/admin/vendor/datatables/examples/resources/examples.php
https://www.wordfence.com/vulnerability-advisories/#CVE-2021-39312

Get alerted when CVE-2021-39312 or the next vulnerability affects your stack