CVE-2021-39312 – This vulnerability in the True Ranker WordPress... (How to Fix)

Q: What is the severity of CVE-2021-39312?

CVE-2021-39312 has a CVSS score of 7.5 (HIGH). This vulnerability in the True Ranker WordPress plugin allows attackers to read arbitrary files on the server, including sensitive configuration files like wp-config.php which contains database credentials. It affects WordPress sites running True Ranker plugin version 2.2.2 or earlier. Attackers can exploit this without authentication via a simple HTTP request.

📋 TL;DR

This vulnerability in the True Ranker WordPress plugin allows attackers to read arbitrary files on the server, including sensitive configuration files like wp-config.php which contains database credentials. It affects WordPress sites running True Ranker plugin version 2.2.2 or earlier. Attackers can exploit this without authentication via a simple HTTP request.

💻 Affected Systems

Products:

WordPress True Ranker plugin

Versions: <= 2.2.2

Operating Systems: All

Default Config Vulnerable: ⚠️ Yes

Notes: All WordPress installations with vulnerable plugin versions are affected regardless of OS or web server configuration.

📦 What is this software?

True Ranker by Trueranker

View all CVEs affecting True Ranker →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Complete server compromise through database credential theft from wp-config.php, leading to data exfiltration, site defacement, or ransomware deployment.

🟠

Likely Case

Sensitive configuration file exposure leading to database access, privilege escalation, and potential site takeover.

🟢

If Mitigated

Limited information disclosure if file permissions restrict access to critical files, but still exposes directory structure and potentially sensitive data.

🌐 Internet-Facing: HIGH

🏢 Internal Only: MEDIUM

🎯 Exploit Status

Public PoC: ⚠️ Yes

Weaponized: CONFIRMED

Unauthenticated Exploit: ⚠️ Yes

Complexity: LOW

Exploitation requires only a web browser or curl command to access the vulnerable endpoint with directory traversal in the src parameter.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: > 2.2.2

Vendor Advisory: https://plugins.trac.wordpress.org/browser/seo-local-rank/

Restart Required: No

Instructions:

1. Log into WordPress admin panel. 2. Navigate to Plugins → Installed Plugins. 3. Find True Ranker plugin. 4. Click 'Update Now' if update available. 5. If no update available, deactivate and delete plugin immediately.

🔧 Temporary Workarounds

Delete vulnerable file

linux

Remove the vulnerable examples.php file that contains the insecure file inclusion

rm /path/to/wordpress/wp-content/plugins/seo-local-rank/admin/vendor/datatables/examples/resources/examples.php

Web server access restriction

all

Block access to the vulnerable endpoint via .htaccess or web server configuration

<LocationMatch "\/admin\/vendor\/datatables\/examples\/resources\/examples\.php">
    Order deny,allow
    Deny from all
</LocationMatch>

🧯 If You Can't Patch

Deactivate and remove the True Ranker plugin completely
Implement WAF rules to block requests containing directory traversal patterns like '../' or absolute paths

🔍 How to Verify

Check if Vulnerable:

Access http://yoursite.com/wp-content/plugins/seo-local-rank/admin/vendor/datatables/examples/resources/examples.php?src=../../../wp-config.php - if it returns your wp-config.php contents, you're vulnerable.

Check Version:

Check WordPress admin panel → Plugins → True Ranker version, or examine /wp-content/plugins/seo-local-rank/readme.txt file version header.

Verify Fix Applied:

Attempt the same request after patching - should return 404 or access denied error.

📡 Detection & Monitoring

Log Indicators:

HTTP requests to /admin/vendor/datatables/examples/resources/examples.php with src parameter containing '../' patterns
Unusual file access patterns from single IP addresses

Network Indicators:

GET requests with directory traversal sequences in URL parameters
Traffic to plugin admin paths from unauthenticated sources

SIEM Query:

url:*/admin/vendor/datatables/examples/resources/examples.php* AND (src:*../* OR src:*wp-config*)

📊 Metadata

CVE ID: CVE-2021-39312

CVSS v3 Score: 7.5 (HIGH)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CWE: CWE-22

Published: December 14, 2021

Last Updated: November 21, 2024

🔗 References

http://packetstormsecurity.com/files/165434/WordPress-The-True-Ranker-2.2.2-Arbitrary-File-Read.html Exploit,Third Party Advisory,VDB Entry
https://plugins.trac.wordpress.org/browser/seo-local-rank/tags/2.2.2/admin/vendor/datatables/examples/resources/examples.php Third Party Advisory
https://www.wordfence.com/vulnerability-advisories/#CVE-2021-39312 Third Party Advisory
http://packetstormsecurity.com/files/165434/WordPress-The-True-Ranker-2.2.2-Arbitrary-File-Read.html Exploit,Third Party Advisory,VDB Entry
https://plugins.trac.wordpress.org/browser/seo-local-rank/tags/2.2.2/admin/vendor/datatables/examples/resources/examples.php Third Party Advisory
https://www.wordfence.com/vulnerability-advisories/#CVE-2021-39312 Third Party Advisory

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2021-39312, you might also want to check these: