Cherry Plugin For Wordpress 1.2.7 Path Traversal Via Download Content Php

Back www.vulncheck.com

Cherry Plugin For Wordpress 1.2.7 Path Traversal Via Download Content Php

www.vulncheck.com • October 21, 2026

Share: View original

CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Ready to get Started?

Vulnerability Prioritization Prioritize vulnerabilities that matter based on the threat landscape and defer vulnerabilities that don't.

Early Warning System Real-time alerting of changes in the vulnerability landscape so that you can take action before the attacks start.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Path Traversal Vulnerabilities in Cherry Plugin and Churchope Theme for WordPress Two separate path traversal vulnerabilities have been identified in the Cherry Plugin for WordPress (version 1.2.7) and the Churchope WordPress Theme (version 2.2). Both vulnerabilities are categorized under CWE-22, allowing attackers to potentially access restricted directories. The vulnerabilities were disclosed on October 21, 2026, but there is no indication of at this time. Users of the affected plugins are advised to update to the latest versions to mitigate risks. Specific CVEs have not been provided in the articles, and no proof-of-concept code has been reported. The scope of impact includes all installations of the affected versions. Current status indicates that users should prioritize patching to prevent potential exploitation. 46

Extracted Entities

CWE Weaknesses (1)

CWE-22 - Path Traversal

Vulnerabilities (1)