CVE-2012-20002

Deferred Deferred - Pending Action

Path Traversal in TinyMCE Thumbnail Gallery WordPress Plugin

Publication date: 2026-10-20

Last updated on: 2026-10-28

Assigner: VulnCheck

Description

TinyMCE Thumbnail Gallery plugin for WordPress before 1.1.0 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files via the href parameter. Attackers can send GET requests to /php/download-image.php with traversal sequences like ../../../../wp-config.php to retrieve database credentials and system files. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-19.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-20

Last Modified

2026-10-28

Generated

2026-11-10

AI Q&A

2026-10-21

EPSS Evaluated

2026-11-08

NVD

CVE-2012-20002

Affected Vendors & Products

Vendor	Product	Version / Range
James Charlesworth	TinyMCE Thumbnail Gallery	0.10

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-22	The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

Executive Summary

This vulnerability is a path traversal issue in the TinyMCE Thumbnail Gallery plugin for WordPress versions before 1.1.0. It allows unauthenticated attackers to read arbitrary files on the server by exploiting the href parameter in GET requests to /php/download-image.php. Attackers can use traversal sequences like ../../../../wp-config.php to access sensitive files such as database credentials and system configurations.

Detection Guidance

Check if the TinyMCE Thumbnail Gallery plugin for WordPress is installed and verify its version. If it is below 1.1.0, the system is vulnerable. Test for path traversal by sending a GET request to /php/download-image.php with a traversal sequence like ../../../../wp-config.php and check if sensitive files are returned.

Impact Analysis

This vulnerability can lead to unauthorized access to sensitive files on your server, including database credentials, configuration files, and other critical system data. Attackers could exploit this to gain insights into your system, potentially leading to further attacks or data breaches. It poses a significant risk to the confidentiality and integrity of your data.

Compliance Impact

This vulnerability can severely impact compliance with standards like GDPR and HIPAA by exposing sensitive data such as personal or health information. Unauthorized access to such data can result in legal penalties, loss of trust, and reputational damage. Organizations must address this vulnerability promptly to maintain compliance and protect user data.

Mitigation Strategies

Update the TinyMCE Thumbnail Gallery plugin to version 1.1.0 or later immediately. If updating is not possible, consider disabling or removing the plugin until a patch is applied. Monitor network traffic for suspicious GET requests to /php/download-image.php.

Hi! I’m here to help you understand CVE-2012-20002. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...