CVE WATCH / VULNERABILITY DETAIL
CVE-2016-20103
HIGHCVSS 7.5NVD feed
Published 20 October 2026 · tracked since 21 October 2026
Description
Cherry Plugin for WordPress before 1.2.7 contains a path traversal vulnerability that allows unauthenticated attackers to download arbitrary files via the 'file' parameter. Attackers can send GET requests to /admin/import-export/download-content.php with traversal sequences like ../../../../../wp-co
References
- NVD — National Vulnerability Database
- CVE.org record (MITRE)
- CISA Known Exploited Vulnerabilities catalog