Vulnerability record · CVE-2012-4915 · published 29 May 2014
CVE-2012-4915: WordPress Google Doc Embedder plugin path traversal in libs/pdf.php
DDavistribe · Google Doc Embedder
The Google Doc Embedder plugin before 2.5.4 for WordPress contains a directory traversal flaw in the file parameter of libs/pdf.php. A remote attacker can supply a .. (dot dot) sequence to read arbitrary files from the server. Because the plugin is publicly reachable and the flaw needs no credentials, any unpatched site running the plugin is exposed.
Description
Directory traversal vulnerability in the Google Doc Embedder plugin before 2.5.4 for WordPress allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter to libs/pdf.php.
AV:N/AC:L/Au:N/C:P/I:N/A:N
Automated analysis
high priorityUnauthenticated remote file disclosure with a very high EPSS score, though the CVSS 2.0 base score is only 5.0 and no KEV listing or confirmed exploit reference exists.
What it is
The Google Doc Embedder plugin before 2.5.4 for WordPress contains a directory traversal flaw in the file parameter of libs/pdf.php. A remote attacker can supply a .. (dot dot) sequence to read arbitrary files from the server. Because the plugin is publicly reachable and the flaw needs no credentials, any unpatched site running the plugin is exposed.
Impact
An attacker gains read access to arbitrary files on the web server, which can expose configuration files, credentials and other sensitive data. There is no write or code execution impact per the CVSS vector (C:P/I:N/A:N).
Attack surface
Reached over the network via HTTP requests to libs/pdf.php with a crafted file parameter; the CVSS vector AV:N/AC:L/Au:N indicates no authentication and no user interaction are required.
Exploitation
Not listed in CISA KEV and no ransomware association is documented; EPSS is high (0.50017, 98.8th percentile), but the references carry no exploit tags, so public exploit availability is not confirmed by this record.
What to do
- Update the Google Doc Embedder plugin to version 2.5.4 or later, or remove the plugin if it is no longer maintained.
- If patching is not immediately possible, block or restrict access to libs/pdf.php and reject requests containing traversal sequences in the file parameter.
- Run the WordPress installation with least-privilege file permissions so readable files are limited.
- Review web server logs for traversal attempts against the plugin path and treat any hits as compromise attempts.
Detection
- Search HTTP access logs for requests to libs/pdf.php containing .. or encoded traversal sequences in the file parameter.
- Alert on requests to libs/pdf.php with absolute paths or file parameters pointing outside the plugin directory.
- Inventory WordPress installations and flag any running Google Doc Embedder below 2.5.4.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2012-4915 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2012-4915), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
