Executive brief
Supsystic Digital Publications is a WordPress plugin used to create digital flipbooks and online publications. A security flaw in the plugin allows attackers to access sensitive files on the server that should be restricted, potentially exposing system information or user data. Additionally, the plugin is vulnerable to script injection, which could allow an attacker to hijack administrative sessions or deface the website when publications are viewed or edited.
Technical details
The Supsystic Digital Publications plugin for WordPress (version 1.6.9 and earlier) contains two primary vulnerabilities. First, a path traversal flaw exists in the 'Folder' input field within the Publications section; by injecting directory traversal sequences (e.g., ../), an attacker can use the readdir() function in utils.php to view files outside the web root. If the server attempts to read a directory without sufficient permissions, it may also trigger an infinite loop, leading to a Denial of Service (DoS) via log exhaustion. Second, the plugin fails to sanitize input fields in publication settings (such as Area Width and Publication Width), enabling stored Cross-Site Scripting (XSS). These scripts execute in the context of any user viewing or editing the affected publication. A fix was reportedly released around December 20, 2020.
Affected products
- Supsystic Digital Publications by Supsystic <= 1.6.9
Timeline
- 2020-07-24: disclosed: Initial discovery and vendor notification by researcher Erik David Martin
- 2020-12-20: patched: Vulnerability fixed by vendor after contact from WordPress Plugin Security team
- 2021-02-08: other: Exploit-DB entry published
- 2026-05-16: advisory: NVD/VulnCheck advisory published