CVE-2021-39312

True Ranker <= 2.2.2 Directory Traversal/Arbitrary File Read

7.5 HighPublic exploit

The True Ranker plugin <= 2.2.2 for WordPress allows arbitrary files, including sensitive configuration files such as wp-config.php, to be accessed via the src parameter found in the ~/admin/vendor/datatables/examples/resources/examples.php file.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: None
Availability: None

Exploit likelihood

77.9%Up 77.3 points since Dec 15, 2021

What each source reports

CVE List Score used 7.5

True Ranker <= 2.2.2 Directory Traversal/Arbitrary File Read

Record: CVE-2021-39312
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness: CWE-22
Updated: 2026-11-02

EUVDEUVD-2021-25673 7.5

Record: EUVD-2021-25673
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated: 2026-11-03

GitHub AdvisoriesGHSA-2mm8-gjg2-whmx No score

The True Ranker plugin <= 2.2.2 for WordPress allows arbitrary files, including sensitive...

Record: GHSA-2mm8-gjg2-whmx
Weakness: CWE-22
Updated: 2026-11-02

NVD 7.5

Record: CVE-2021-39312
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS 2.0: 5.0 MediumAV:N/AC:L/Au:N/C:P/I:N/A:N
Weakness: CWE-22
Updated: 2026-11-02

Affected products

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
Exploit-DB	WordPress Plugin The True Ranker 2.2.2 - Arbitrary File Read (Unauthenticated)	2022-01-05
Nuclei	WordPress True Ranker <2.2.4 - Local File Inclusion
PoC in GitHub	root-wav/wordpress-true-ranker-cve-2021-39312	2022-01-24

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases, products, published	EUVD
Nov 2, 2026	first indexed	CVE List, Exploit-DB, GitHub Advisories, Nuclei, NVD, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2021-39312 is a high vulnerability (CVSS 7.5) in Optimizza True Ranker, published December 14, 2021. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 77.9%, the 99th percentile. No source names a fixed version.