CVE-2018-16283: WordPress Wechat Broadcast plugin directory traversal via Image.php url parameter

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

critical priorityCVSS 9.8 with network reachability, no authentication, no user interaction and public exploit code makes this a high-urgency issue for any exposed instance.

What it is

The Wechat Broadcast plugin 1.2.0 and earlier for WordPress is vulnerable to directory traversal through the url parameter in Image.php. An unauthenticated remote attacker can use crafted path sequences to read files outside the intended directory. The flaw carries a CVSS 3.0 base score of 9.8 (critical) and a CWE-22 classification.

Impact

An attacker can read arbitrary files on the web server, potentially exposing configuration files, credentials and other sensitive data. The CVSS vector indicates high confidentiality, integrity and availability impact, though the description only details file read behavior.

Attack surface

Reachable over the network through the WordPress plugin's Image.php endpoint with no authentication and no user interaction required, per the CVSS vector AV:N/AC:L/PR:N/UI:N. Any internet-exposed WordPress instance running the affected plugin is a candidate target.

Exploitation

Public exploit references exist (Exploit-DB 45438, Full Disclosure mailing list, WPVulnDB), and EPSS reports a 30-day probability of 0.6307 at the 99.164th percentile. The CVE is not listed in CISA KEV and no ransomware groups are documented as using it.

What to do

• Update or remove the Wechat Broadcast plugin; version 1.2.0 and earlier are affected and no fixed version is stated in the record.
• If the plugin cannot be removed, block or restrict access to Image.php at the web server or WAF layer.
• Validate and sanitize the url parameter, rejecting path traversal sequences, as a compensating control if code changes are possible.
• Run WordPress with least-privilege file permissions so traversal reads expose as little as possible.

Detection

• Monitor web server logs for requests to Image.php containing traversal sequences such as ../ or encoded variants.
• Alert on unusual file paths or sensitive filenames appearing in Image.php query strings.
• Review outbound or local file access patterns from the WordPress process for reads outside the web root.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.