CVE-2019-1010257
📋 TL;DR
This vulnerability in the article2pdf WordPress plugin allows attackers to download any PDF file accessible to the web server by manipulating file paths. It can also delete files after download if server permissions allow. WordPress sites using vulnerable plugin versions are affected.
💻 Affected Systems
- WordPress article2pdf plugin
📦 What is this software?
Article2pdf by Article2pdf Project
⚠️ Risk & Real-World Impact
Worst Case
Attackers can read sensitive PDF files (including confidential documents), delete critical files causing denial of service, and potentially read arbitrary files on PHP <5.3 systems via null byte injection.
Likely Case
Unauthorized access to PDF files stored on the server, potential data leakage of sensitive documents, and possible file deletion disrupting site functionality.
If Mitigated
Limited to accessing only PDF files with known paths that are readable by the web server user.
🎯 Exploit Status
Exploitation requires constructing a specific URL with manipulated file path parameters.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 0.28 or later
Vendor Advisory: https://wordpress.org/support/topic/pdf-download-path-improperly-sanitised/
Restart Required: No
Instructions:
1. Update article2pdf plugin to version 0.28 or later via WordPress admin panel. 2. Verify the update completed successfully. 3. Test PDF download functionality.
🔧 Temporary Workarounds
Disable article2pdf plugin
allTemporarily disable the vulnerable plugin until patching is possible
wp plugin deactivate article2pdf
Restrict access to article2pdf_getfile.php
linuxBlock direct access to the vulnerable script via web server configuration
# Apache: <LocationMatch "article2pdf_getfile\.php">
Order deny,allow
Deny from all
</LocationMatch>
# Nginx: location ~ article2pdf_getfile\.php { deny all; }
🧯 If You Can't Patch
- Remove the article2pdf plugin completely from the WordPress installation
- Implement strict file permission controls to limit web server access to sensitive directories
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin panel for article2pdf plugin version. If version is 0.24, 0.25, 0.26, or 0.27, the system is vulnerable.Check Version:
wp plugin list --name=article2pdf --field=versionVerify Fix Applied:
Verify article2pdf plugin version is 0.28 or higher in WordPress admin panel.📡 Detection & Monitoring
Log Indicators:
- Unusual access patterns to article2pdf_getfile.php with manipulated file paths
- Multiple failed attempts to access non-existent PDF files
- File deletion events in web server logs
Network Indicators:
- HTTP requests containing path traversal sequences (../) to article2pdf_getfile.php
- Requests with null byte characters (%00) in file parameters
SIEM Query:
source="web_server_logs" AND (uri="*article2pdf_getfile.php*" AND (uri="*../*" OR uri="*%00*"))🔗 References
- https://packetstormsecurity.com/files/152236/WordPress-article2pdf-0.24-DoS-File-Deletion-Disclosure.html
- https://seclists.org/bugtraq/2019/Mar/49
- https://wordpress.org/support/topic/pdf-download-path-improperly-sanitised/
- https://wpvulndb.com/vulnerabilities/9246
- https://packetstormsecurity.com/files/152236/WordPress-article2pdf-0.24-DoS-File-Deletion-Disclosure.html
- https://seclists.org/bugtraq/2019/Mar/49
- https://wordpress.org/support/topic/pdf-download-path-improperly-sanitised/
- https://wpvulndb.com/vulnerabilities/9246
