CVE-2018-16283
Description
The Wechat Broadcast plugin 1.2.0 and earlier for WordPress allows Directory Traversal via the Image.php url parameter.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
2- Range: v1.0.0-beta, v1.1.2, v1.2.0
- Range: <=1.2.0
Patches
Vulnerability mechanics
Root cause
"Missing input validation on the `url` parameter in Image.php allows directory traversal and file inclusion."
Attack vector
An unauthenticated attacker sends a GET request to `/wp-content/plugins/wechat-broadcast/wechat/Image.php` with a `url` parameter containing path traversal sequences (e.g., `../../../../etc/passwd`) or a remote URL. The vulnerable code `file_get_contents(isset($_GET["url"]) ? $_GET["url"] : '')` passes the unsanitized parameter directly to `file_get_contents()`, enabling local file inclusion (LFI) or remote file inclusion (RFI) [ref_id=1]. The attacker only needs HTTP/1.0 protocol access to the WordPress site [ref_id=1].
Affected code
The vulnerable file is `/wechat-broadcast/wechat/Image.php` [ref_id=1]. The offending line is `echo file_get_contents(isset($_GET["url"]) ? $_GET["url"] : '');` which passes the unsanitized `url` parameter directly to `file_get_contents()` [ref_id=1].
What the fix does
No patch is published in the bundle. The advisory [ref_id=1] identifies the root cause as the unsanitized `$_GET["url"]` parameter passed directly to `file_get_contents()`. The remediation would require validating the `url` parameter against an allowlist of permitted paths or domains, or removing the raw user-controlled file read entirely.
Preconditions
- networkAttacker must be able to send HTTP GET requests to the WordPress site.
- inputThe vulnerable plugin (Wechat Broadcast 1.2.0 or earlier) must be installed and active.
Reproduction
1. Ensure the Wechat Broadcast plugin 1.2.0 or earlier is installed on a WordPress site. 2. Send a GET request to `/wordpress/wp-content/plugins/wechat-broadcast/wechat/Image.php?url=../../../../../../../../../../etc/passwd` to read local files. 3. Alternatively, use a remote URL such as `http://malicious.url/shell.txt` for remote file inclusion [ref_id=1].
Generated on May 25, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.
References
4- www.exploit-db.com/exploits/45438/mitreexploitx_refsource_EXPLOIT-DB
- seclists.org/fulldisclosure/2018/Sep/32mitremailing-listx_refsource_FULLDISC
- github.com/springjk/wordpress-wechat-broadcast/issues/14mitrex_refsource_CONFIRM
- wpvulndb.com/vulnerabilities/9132mitrex_refsource_MISC
News mentions
0No linked articles in our index yet.