Executive brief
The IMDb Profile Widget plugin for WordPress, which displays movie profile information, contains a security flaw that allows unauthorized individuals to view private files on the web server. By exploiting this vulnerability, an attacker could access sensitive configuration files containing database passwords and other internal credentials. This could lead to a full compromise of the website's data and underlying infrastructure.
Technical details
A local file inclusion (LFI) vulnerability exists in the IMDb Profile Widget plugin version 1.0.8 for WordPress. The issue resides in the 'pic.php' file, which uses the PHP 'readfile()' function on the 'url' GET parameter without sufficient validation or sanitization. An unauthenticated attacker can use directory traversal sequences (e.g., ../../../) to bypass the intended directory and read sensitive system files, such as 'wp-config.php'. While the CVSS vector indicates a local attack vector, this typically refers to the context of the file system access on the server via the web application. The plugin has been closed and is no longer available for download on the WordPress repository.
Affected products
- Henrique Dias IMDb Profile Widget 1.0.8
Timeline
- 2016-03-26: other: Vendor informed of the issue
- 2016-03-27: disclosed: Exploit published on Exploit-DB
- 2017-12-19: other: Plugin closed on WordPress.org repository due to guideline violations
- 2026-06-15: advisory: CVE published and added to NVD