CVE-2021-39312: True Ranker WordPress plugin path traversal allows arbitrary file read

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

high priorityUnauthenticated remote file read of wp-config.php is a serious exposure, and the very high EPSS score plus a public exploit reference raise the likelihood of exploitation.

What it is

The True Ranker plugin for WordPress, versions up to and including 2.2.2, exposes a src parameter in its bundled DataTables example file that is not properly restricted, allowing path traversal. An unauthenticated attacker can use it to read arbitrary files on the server, including wp-config.php, which holds database credentials and authentication salts.

Impact

An attacker gains read access to sensitive server files, most critically wp-config.php, exposing database credentials and secret keys that can be used to pivot to the underlying database or forge WordPress authentication cookies.

Attack surface

The flaw is reachable over the network through the plugin's admin/vendor/datatables/examples/resources/examples.php endpoint via the src parameter. The CVSS vector shows no privileges required and no user interaction, so it can be triggered by an unauthenticated remote request.

Exploitation

No CISA KEV listing and no ransomware association are recorded, but EPSS is very high at roughly 0.78 (99.5th percentile) and a public exploit reference exists on Packet Storm, indicating active interest and easy weaponization.

What to do

• Update the True Ranker plugin to a version later than 2.2.2, or remove the plugin if no fixed release is available.
• If the plugin cannot be patched immediately, block or restrict access to the admin/vendor/datatables/examples/ path at the web server or WAF.
• Rotate database credentials and WordPress authentication salts in wp-config.php if compromise is suspected.
• Remove or restrict access to bundled vendor example and test files that are not needed in production.

Detection

• Search web server logs for requests to examples.php with a src parameter containing traversal sequences such as ../ or encoded variants.
• Alert on access to admin/vendor/datatables/examples/resources/examples.php from external or unexpected source IPs.
• Monitor for outbound database connections or authentication anomalies that could follow exposure of wp-config.php credentials.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.