Executive brief
The Brandfolder plugin for WordPress, which allows users to manage digital assets like logos and images directly within their website, contains a security flaw. An unauthorized attacker can exploit this to view sensitive system files, such as configuration files containing database passwords. In some cases, this could lead to a complete takeover of the website or the underlying server.
Technical details
A Local/Remote File Inclusion (LFI/RFI) vulnerability exists in the WordPress Brandfolder plugin (v3.0 and earlier) due to improper sanitization of the 'wp_abspath' parameter in the callback.php file. The script uses this parameter directly in require_once() statements to load WordPress core files. An unauthenticated attacker can provide path traversal sequences (e.g., ../../../wp-config.php) or remote URLs to include and execute arbitrary PHP code or read sensitive local files. While the CVSS vector provided by the source indicates local access (AV:L), the nature of the PHP callback script typically allows for remote exploitation via HTTP requests. The vulnerability was addressed in later versions of the plugin.
Affected products
- Brandfolder Brandfolder <= 3.0
Timeline
- 2016-03-22: disclosed: Initial exploit published on Exploit-DB
- 2026-06-15: advisory: NVD/VulnCheck advisory published