CVE-2018-9118: WordPress Background Takeover Advertisements plugin directory traversal

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: high.

high priorityUnauthenticated remote file read with public exploit code and very high EPSS, though not in KEV.

What it is

The 99 Robots WP Background Takeover Advertisements plugin before 4.1.5 for WordPress contains a directory traversal flaw in exports/download.php. The filename parameter accepts '..' sequences, letting a remote unauthenticated request read files outside the intended export directory. Because the plugin runs inside WordPress, exposed files can include configuration and credential material.

Impact

An attacker can read arbitrary files on the web server that the PHP process can access, including wp-config.php and other sensitive data. The CVSS vector shows high confidentiality impact with no integrity or availability effect.

Attack surface

Reached over the network through exports/download.php with a crafted filename parameter; the CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates no authentication and no user interaction are required.

Exploitation

Public exploit references exist (Exploit-DB 44417 and WPScan/wpvulndb 9056), and EPSS is 0.46931 (98.8th percentile), though the CVE is not listed in CISA KEV.

What to do

• Update the WP Background Takeover Advertisements plugin to 4.1.5 or later, or remove it if unused.
• Block or restrict direct access to exports/download.php at the web server or WAF.
• Validate and canonicalize the filename parameter, rejecting any path traversal sequences.
• Run WordPress with least-privilege file permissions and keep wp-config.php outside the web root where possible.
• Monitor plugin advisories for this and similar components.

Detection

• Search web logs for requests to exports/download.php containing '..' or encoded traversal sequences in the filename parameter.
• Alert on HTTP 200 responses from that endpoint returning non-image or unexpected file content.
• Review file access logs for reads of wp-config.php or other sensitive files by the web server user.
• Use a WAF rule to flag traversal patterns targeting plugin export endpoints.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.