CVE-2018-7422: WordPress Site Editor plugin path traversal allows arbitrary file read

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

high priorityUnauthenticated remote arbitrary file read with public exploit code and very high EPSS probability, though no KEV listing or confirmed active exploitation is recorded.

What it is

The Site Editor plugin through version 1.1.1 for WordPress contains a local file inclusion flaw in editor/extensions/pagebuilder/includes/ajax_shortcode_pattern.php. The ajax_path parameter is not properly validated, allowing absolute path traversal. This lets an unauthenticated remote attacker read arbitrary files from the web server.

Impact

An attacker can retrieve arbitrary files readable by the web server process, exposing configuration files, credentials, and other sensitive data. There is no integrity or availability impact, only confidentiality loss.

Attack surface

Reachable over the network via HTTP requests to the vulnerable ajax_shortcode_pattern.php endpoint with a crafted ajax_path parameter. Per the CVSS vector, no authentication and no user interaction are required.

Exploitation

Public exploit code is referenced in Exploit-DB and Full Disclosure, and EPSS shows a high 30-day probability of 0.6225 (99th percentile). The CVE is not listed in CISA KEV, so no confirmed in-the-wild exploitation is documented in this record.

What to do

• Update the Site Editor plugin beyond version 1.1.1 or remove it if no fixed release is available.
• If the plugin cannot be patched or removed, disable or block access to editor/extensions/pagebuilder/includes/ajax_shortcode_pattern.php at the web server or WAF.
• Validate and restrict the ajax_path parameter to expected values, rejecting absolute paths and traversal sequences.
• Run WordPress with least-privilege file permissions so the web server cannot read sensitive files outside the web root.
• Monitor plugin advisories and apply vendor fixes promptly.

Detection

• Search web server logs for requests to ajax_shortcode_pattern.php with ajax_path values containing ../ or absolute paths.
• Alert on access to sensitive files such as wp-config.php, /etc/passwd, or .env via this endpoint.
• Use a WAF rule to flag path traversal patterns in the ajax_path parameter.
• Review file access logs for unusual reads of configuration or credential files by the web server user.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.