Executive brief
The Amministrazione Aperta plugin for WordPress, which is used by Italian public institutions to manage transparency data, contains a security flaw that allows unauthorized users to read private files from the web server. By sending a specially crafted web request, an attacker could access sensitive configuration files or system data. This could lead to the exposure of administrative credentials or other confidential information, potentially compromising the entire website.
Technical details
A local file inclusion (LFI) / path traversal vulnerability exists in the 'amministrazione-aperta' WordPress plugin version 3.7.3. The flaw is located in the 'dispatcher.php' file, where the 'open' GET parameter is passed directly to a PHP include() function without sufficient sanitization or validation. An unauthenticated attacker can exploit this by providing relative path sequences (e.g., ../) to traverse the file system and read arbitrary files accessible to the web server process, such as wp-config.php. While the CVSS vector indicates a local attack vector, this is typically exploitable via remote web requests to the vulnerable endpoint. Version 3.8 of the plugin contains security improvements that likely address this issue.
Affected products
- Marco Milesi amministrazione-aperta 3.7.3
Timeline
- 2020-12-01: other: Version 3.7.3 released
- 2022-03-23: disclosed: Exploit published on Exploit-DB and version 3.8 released with security improvements
- 2026-05-10: advisory: CVE published/updated by VulnCheck