CVE-2015-5468

Directory traversal vulnerability in the WP e-Commerce Shop Styling plugin before 2.6 for WordPress allows remote attackers to read arbitrary files via a .. (dot dot) in the filename parameter to includes/download.php.

• CWE-22

• http://www.openwall.com/lists/oss-security/2015/07/06/19Exploit, Mailing List, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2015/07/10/4Mailing List, Patch, Third Party Advisory
• http://www.vapid.dhs.org/advisory.php?v=136Exploit, Third Party Advisory, VDB Entry
• https://wordpress.org/plugins/wp-ecommerce-shop-styling/#developersRelease Notes, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2015/07/06/19Exploit, Mailing List, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2015/07/10/4Mailing List, Patch, Third Party Advisory
• http://www.vapid.dhs.org/advisory.php?v=136Exploit, Third Party Advisory, VDB Entry
• https://wordpress.org/plugins/wp-ecommerce-shop-styling/#developersRelease Notes, Third Party Advisory

Published

May 23, 2017

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2015-5462AxiomSL's Axiom Google Web Toolkit module 9.5.3 and earlier …
• CVE-2015-5463AxiomSL's Axiom java applet module (used for editing uploade…
• CVE-2015-5464The Gemalto SafeNet Luna HSM allows remote authenticated use…
• CVE-2015-5465Silicon Integrated Systems WindowsXP Display Manager (aka VG…
• CVE-2015-5466Silicon Integrated Systems XGI WindowsXP Display Manager (ak…7.8
• CVE-2015-5467web\ViewAction in Yii (aka Yii2) 2.x before 2.0.5 allows att…9.8
• CVE-2015-5469Absolute path traversal vulnerability in the MDC YouTube Dow…
• CVE-2015-5470The label decompression functionality in PowerDNS Recursor b…
• CVE-2015-5471Absolute path traversal vulnerability in include/user/downlo…
• CVE-2015-5472Absolute path traversal vulnerability in lib/download.php in…
• CVE-2015-5473Multiple directory traversal vulnerabilities in Samsung Sync…
• CVE-2015-5474BitTorrent and uTorrent allow remote attackers to inject com…