Skip to content

CVE-2008-0196

Multiple directory traversal vulnerabilities in WordPress 2.0.11 and earlier allow remote...

5.0 MediumFix available

Multiple directory traversal vulnerabilities in WordPress 2.0.11 and earlier allow remote attackers to read arbitrary files via a .. (dot dot) in (1) the page parameter to certain PHP scripts under wp-admin/ or (2) the import parameter to wp-admin/admin.php, as demonstrated by discovering the full path via a request for the ....\wp-config pathname; and allow remote attackers to modify arbitrary files via a .. (dot dot) in the file parameter to wp-admin/templates.php.

Exploit likelihood

3.42%Up 1.3 points since Feb 4, 2022

What each source reports

NVD Score used5.0

Multiple directory traversal vulnerabilities in WordPress 2.0.11 and earlier allow remote attackers to read arbitrary files via a .. (dot dot) in (1) the page parameter to certain PHP scripts under wp-admin/ or (2) the import parameter to wp-admin/admin.php, as demonstrated by discovering the full path via a request for the ....\wp-config pathname; and allow remote attackers to modify arbitrary files via a .. (dot dot) in the file parameter to wp-admin/templates.php.

Record: CVE-2008-0196
CVSS 2.0: 5.0 MediumAV:N/AC:L/Au:N/C:P/I:N/A:N
Weakness: CWE-22
Updated: 2026-11-02

CVE ListNo score

Multiple directory traversal vulnerabilities in WordPress 2.0.11 and earlier allow remote attackers to read arbitrary files via a .. (dot dot) in (1) the page parameter to certain PHP scripts under wp-admin/ or (2) the import parameter to wp-admin/admin.php, as demonstrated by discovering the full path via a request for the ....\wp-config pathname; and allow remote attackers to modify arbitrary files via a .. (dot dot) in the file parameter to wp-admin/templates.php.

Record: CVE-2008-0196
Updated: 2026-11-02

EUVDEUVD-2008-0208No score

Multiple directory traversal vulnerabilities in WordPress 2.0.11 and earlier allow remote attackers to read arbitrary files via a .. (dot dot) in (1) the page parameter to certain PHP scripts under wp-admin/ or (2) the import parameter to wp-admin/admin.php, as demonstrated by discovering the full path via a request for the ....\wp-config pathname; and allow remote attackers to modify arbitrary files via a .. (dot dot) in the file parameter to wp-admin/templates.php.

Record: EUVD-2008-0208
Updated: 2026-11-03

GitHub AdvisoriesGHSA-752f-j58r-mc8qNo score

Multiple directory traversal vulnerabilities in WordPress 2.0.11 and earlier allow remote...

Multiple directory traversal vulnerabilities in WordPress 2.0.11 and earlier allow remote attackers to read arbitrary files via a .. (dot dot) in (1) the page parameter to certain PHP scripts under wp-admin/ or (2) the import parameter to wp-admin/admin.php, as demonstrated by discovering the full path via a request for the ....\wp-config pathname; and allow remote attackers to modify arbitrary files via a .. (dot dot) in the file parameter to wp-admin/templates.php.

Record: GHSA-752f-j58r-mc8q
Weakness: CWE-22
Updated: 2026-11-02

OSVNo score

Multiple directory traversal vulnerabilities in WordPress 2.0.11 and earlier allow remote attackers to read arbitrary files via a .. (dot dot) in (1) the page parameter to certain PHP scripts under wp-admin/ or (2) the import parameter to wp-admin/admin.php, as demonstrated by discovering the full path via a request for the ....\wp-config pathname; and allow remote attackers to modify arbitrary files via a .. (dot dot) in the file parameter to wp-admin/templates.php.

Record: CVE-2008-0196
Updated: 2026-11-02

OSVDEBIAN-CVE-2008-0196No score

Multiple directory traversal vulnerabilities in WordPress 2.0.11 and earlier allow remote attackers to read arbitrary files via a .. (dot dot) in (1) the page parameter to certain PHP scripts under wp-admin/ or (2) the import parameter to wp-admin/admin.php, as demonstrated by discovering the full path via a request for the ....\wp-config pathname; and allow remote attackers to modify arbitrary files via a .. (dot dot) in the file parameter to wp-admin/templates.php.

Record: DEBIAN-CVE-2008-0196
Updated: 2026-11-02

Affected products

wordpress

Affected packages

Affected packages
Package	Affected	Fixed
`wordpress` Debian:12	before 2.3.3-1	2.3.3-1
`wordpress` Debian:13	before 2.3.3-1	2.3.3-1
`wordpress` Debian:14	before 2.3.3-1	2.3.3-1

History

History
Recorded	Changed	Sources
Nov 10, 2026	facts
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2008-0196 is a medium vulnerability (CVSS 5.0) in Wordpress, published January 10, 2008. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.42%, the 89th percentile. Fixed in wordpress 2.3.3-1.

References

Show 8 moreShow less