CVE-2017-20287

Javo Spot theme for WordPress before 3.0.0 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files via the fn parameter of the jvfrm_spot_get_json AJAX action. Attackers can send GET requests to /wp-admin/admin-ajax.php with fn set to ../../wp-config.php to retrieve database credentials and secret keys. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-19.

• CWE-22

• https://codeseekah.com/2017/02/09/javo-themes-spot-lfi-vulnerability/
• https://github.com/projectdiscovery/nuclei-templates/blob/main/http/vulnerabilities/wordpress/wp-javospot-lfi.yaml
• https://themeforest.net/item/javo-spot-multi-purpose-directory-wordpress-theme/13198068
• https://wpscan.com/vulnerability/2d465fc4-d4fa-43bb-9c0d-71dcc3ee4eab
• https://www.vulncheck.com/advisories/javo-spot-wordpress-theme-3.0.0-path-traversal-via-admin-ajax-php-fn-parameter

Published

Oct 22, 2026

Last Modified

Oct 22, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-20281Joomla! Component Extra Search 2.2.8 contains an SQL injecti…8.2
• CVE-2017-20282Joomla! Component jCart for OpenCart 2.0 contains an SQL inj…8.2
• CVE-2017-20283NXP MQX Classic before 5.0 contains an out-of-bounds write v…6.5
• CVE-2017-20284Caucho Resin contains a path traversal vulnerability in the …7.5
• CVE-2017-20285YAML versions before 1.30 for Perl allow a loaded document t…9.1
• CVE-2017-20286DevIL through 1.8.0 contains a heap-based buffer overflow in…7.8
• CVE-2017-20288QCubed 2.2.0 through 3.1.1 contains a reflected cross-site s…6.1
• CVE-2017-20289Broadstreet Ad Widget plugin for WordPress 2.2.0 before 2.12…7.5
• CVE-2017-2029Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
• CVE-2017-20290Discourse 1.9.0.beta2 before 1.9.0.beta13 contains a reflect…6.1
• CVE-2017-2030Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
• CVE-2017-2031Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…