Path traversal and file read in WordPress plugins
Path traversal lets an attacker reach files outside the folder a plugin meant to use, usually by putting ../ in a file name. Most of these records are file reads: the attacker downloads a file they should not see.
The file attackers want most on a WordPress site is wp-config.php, which holds the database password and the secret keys. With those they may be able to log in to the database or forge login cookies.
What to do: update the plugin. If you ran a vulnerable version, change the database password and generate new salts in wp-config.php (this logs everyone out, which is the point).
Worried a plugin bug was used on your site?
The free scan reads the public side of your site and looks for spam pages, hidden redirects, injected scripts and blacklist entries. No login, no install, about a minute.
Newest Path traversal and file read records
336 on record for the plugins we track; the newest 100 are below. Data as of 2026-11-04.
“Affected” is the version range the source gives. “Fixed in” is the version the source names, or (marked *) the first wordpress.org release after the last affected version. Each CVE id links to the full record on the plugin’s page.
-
medium 4.3 Academy LMS
Path traversal / file read
-
medium 6.5 JetFormBuilder
Path traversal / file read
-
medium 5.4 Revopic
Path traversal / file read
-
high 7.5 WP Easy Pay
Path traversal / file read
-
medium 4.9 Tainacan
Path traversal / file read
-
medium 4.2 AI Engine
Path traversal / file read
-
medium 6.4 GeoDirectory
Path traversal / file read
-
high 7.5 Music Store
Path traversal / file read
-
medium 6.5 Advanced Custom Fields
Path traversal / file read
-
high 7.5 weForms
Path traversal / file read
-
high 7.7 MapSVG
Path traversal / file read
-
medium 5.4 weForms
Path traversal / file read
-
medium 4.9 Post Export Import with Media
Path traversal / file read
-
medium 6.5 Tainacan
Path traversal / file read
-
high 7.5 10Web Booster
Path traversal / file read
-
medium 5.9 Debloat
Path traversal / file read
-
high 8.6 Ultimate Multisite
Path traversal / file read
-
critical 9.8 rtMedia for WordPress, BuddyPress and bbPress
Path traversal / file read
-
medium 6.5 SiteOrigin Widgets Bundle
Path traversal / file read
-
medium 5.4 W3 Total Cache
Path traversal / file read
-
medium 4.9 Post Export Import with Media
Path traversal / file read
-
high 7.5 Generate PDF using Contact Form 7
Path traversal / file read
-
high 7.5 PDF for Contact Form 7 + Drag and Drop Templat…
Path traversal / file read
-
medium 6.5 Piotnet Addons For Elementor
Path traversal / file read
-
medium 6.8 Loco Translate
Path traversal / file read
-
high 7.5 Creator LMS
Path traversal / file read
-
high 7.5 Photo Gallery, Sliders, Proofing and Themes
Path traversal / file read
-
high 7.5 Product Designer App
Path traversal / file read
-
medium 4.9 SSL Zen
Path traversal / file read
-
medium 4.1 Link Library
Path traversal / file read
-
high 7.2 MasterStudy LMS WordPress Plugin
Path traversal / file read
-
medium 4.9 Store Exporter
Path traversal / file read
-
high 7.5 Printcart Store
Path traversal / file read
-
medium 6.8 WP Import Export Lite
Path traversal / file read
-
medium 6.5 Groundhogg
Path traversal / file read
-
medium 6.5 affects latest 1.3.7 Youzify
Path traversal / file read
-
medium 4.9 WP BackItUp Community Edition
Path traversal / file read
-
high 7.5 Direct Download for WooCommerce
Path traversal / file read
-
medium 5.5 WPvivid
Path traversal / file read
-
medium 6.6 WPvivid
Path traversal / file read
-
medium 5.4 Directorist
Path traversal / file read
-
high 7.7 AI Engine
Path traversal / file read
-
medium 6.5 WebToffee WooCommerce PDF Invoices, Packing Sl…
Path traversal / file read
-
critical 9.8 Mailgun for WordPress
Path traversal / file read
-
critical 10.0 W3 Total Cache
Path traversal / file read
-
medium 4.9 Product Feed Manager for WooCommerce
Path traversal / file read
-
medium 4.9 Kirki
Path traversal / file read
-
critical 9.1 WPvivid
Path traversal / file read
-
medium 6.5 StoreEngine
Path traversal / file read
-
high 7.5 ToneDen Shortcode
Path traversal / file read
-
medium 5.0 AI Engine
Path traversal / file read
-
medium 6.5 W3 Total Cache
Path traversal / file read
-
medium 6.5 Unlimited Elements for Elementor
Path traversal / file read
-
medium 4.9 Import and export users and customers
Path traversal / file read
-
high 7.5 CubeWP Framework
Path traversal / file read
-
high 7.5 User Access Manager
Path traversal / file read
-
medium 5.3 Support Genix
Path traversal / file read
-
high 7.5 Bit integrations
Path traversal / file read
-
medium 4.9 SpeedyCache
Path traversal / file read
-
high 7.5 Demi
Path traversal / file read
-
medium 4.3 Nexter Blocks
Path traversal / file read
-
medium 6.5 WCPOS
Path traversal / file read
-
medium 4.4 WP Encryption
Path traversal / file read
-
medium 5.9 Bit Form
Path traversal / file read
-
medium 6.5 All-in-One WP Migration and Backup
Path traversal / file read
-
medium 4.9 Kirki
Path traversal / file read
-
high 8.1 AI Engine
Path traversal / file read
-
high 7.5 Forminator Forms
Path traversal / file read
-
high 8.6 Membership For WooCommerce
Path traversal / file read
-
critical 9.9 SureDash
Path traversal / file read
-
high 8.6 Groundhogg
Path traversal / file read
-
high 7.5 W3 Total Cache
Path traversal / file read
-
high 7.5 Hide My WP Lite
Path traversal / file read
-
medium 5.3 ARMember
Path traversal / file read
-
medium 5.3 Bulk Order Update for WooCommerce
Path traversal / file read
-
high 7.5 Jssor Slider by jssor.com
Path traversal / file read
-
high 7.5 AR for WooCommerce
Path traversal / file read
-
high 7.5 AR for WordPress
Path traversal / file read
-
medium 6.5 Database for Contact Form 7, WPforms, Elemento…
Path traversal / file read
-
medium 6.5 PixMagix
Path traversal / file read
-
high 7.1 Embed Privacy
Path traversal / file read
-
medium 4.9 Woosa
Path traversal / file read
-
medium 6.5 Royal Addons for Elementor
Path traversal / file read
-
high 7.5 Woocommerce Book Price
Path traversal / file read
-
high 7.5 WPBot
Path traversal / file read
-
critical 9.6 FastDup
Path traversal / file read
-
high 7.5 Shared Files
Path traversal / file read
-
high 7.5 WPC Product Options for WooCommerce
Path traversal / file read
-
high 8.8 WP Customer Area
Path traversal / file read
-
medium 4.4 Download Monitor
Path traversal / file read
-
medium 4.9 LWS Optimize
Path traversal / file read
-
medium 4.9 Smart Slider 3
Path traversal / file read
-
medium 4.9 LearnPress
Path traversal / file read
-
medium 4.4 Quick Playground
Path traversal / file read
-
medium 6.5 Classified Listing
Path traversal / file read
-
critical 9.9 QuickWebP
Path traversal / file read
-
critical 9.9 WebinarIgnition
Path traversal / file read
-
high 8.6 VikBooking Hotel Booking Engine & PMS
Path traversal / file read
-
high 7.5 Quick Playground
Path traversal / file read
-
high 8.1 Database Backup for WordPress
Path traversal / file read
Other types
Cross-site scripting (XSS) · Missing authorization · Cross-site request forgery (CSRF) · SQL injection · Sensitive data exposure · PHP object injection · Privilege escalation · Remote code execution · Arbitrary file upload · Authentication bypass · File inclusion · Server-side request forgery (SSRF) · Arbitrary file deletion · Open redirect · Denial of service · Content injection
Browse vulnerabilities
Common types: Cross-site scripting (XSS) · Missing authorization · Cross-site request forgery (CSRF) · SQL injection · Sensitive data exposure · PHP object injection · Privilege escalation · Remote code execution
Where this data comes from
- Vulnerabilities: NIST National Vulnerability Database (NVD), checked 2026-11-04. This product uses data from the NVD API but is not endorsed or certified by the NVD.
- Plugin versions, update dates and install counts: the wordpress.org Plugins API.
- These lists cover the 3,948 plugins in our catalogue, not every plugin on wordpress.org. We only list a CVE for a plugin when its references or its advisory name that exact plugin, so a few real issues may be missing. Spot an error? Email Daniel.