{"id":"CVE-2021-39312","aliases":["EUVD-2021-25673","GHSA-2mm8-gjg2-whmx"],"status":"published","title":"True Ranker \u003c= 2.2.2 Directory Traversal/Arbitrary File Read","description":"The True Ranker plugin \u003c= 2.2.2 for WordPress allows arbitrary files, including sensitive configuration files such as wp-config.php, to be accessed via the src parameter found in the ~/admin/vendor/datatables/examples/resources/examples.php file.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.77944,"percentile":0.99578,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-22"],"published":"2021-12-14T15:50:17Z","modified":"2026-06-17T04:03:31Z","exploits":[{"source":"exploitdb","id":"EDB-50624","title":"WordPress Plugin The True Ranker 2.2.2 - Arbitrary File Read (Unauthenticated)","type":"webapps","platform":"php","date":"2022-01-05","url":"https://www.exploit-db.com/exploits/50624"},{"source":"nuclei","id":"CVE-2021-39312","title":"WordPress True Ranker \u003c2.2.4 - Local File Inclusion","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-39312.yaml"},{"source":"pocgithub","id":"root-wav/wordpress-true-ranker-cve-2021-39312","title":"root-wav/wordpress-true-ranker-cve-2021-39312","date":"2022-01-24","url":"https://github.com/root-wav/wordpress-true-ranker-cve-2021-39312"}],"products":[{"vendor":"optimizza","product":"true ranker"},{"vendor":"true ranker","product":"true ranker"},{"vendor":"trueranker","product":"true_ranker"}],"references":[{"url":"https://www.wordfence.com/vulnerability-advisories/#CVE-2021-39312","tags":["x_refsource_MISC","x_transferred","Third Party Advisory"]},{"url":"https://plugins.trac.wordpress.org/browser/seo-local-rank/tags/2.2.2/admin/vendor/datatables/examples/resources/examples.php","tags":["x_refsource_MISC","x_transferred","Third Party Advisory"]},{"url":"http://packetstormsecurity.com/files/165434/WordPress-The-True-Ranker-2.2.2-Arbitrary-File-Read.html","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-39312"},{"url":"https://github.com/advisories/GHSA-2mm8-gjg2-whmx"}],"sources":{"cve":[{"id":"CVE-2021-39312","title":"True Ranker \u003c= 2.2.2 Directory Traversal/Arbitrary File Read","description":"The True Ranker plugin \u003c= 2.2.2 for WordPress allows arbitrary files, including sensitive configuration files such as wp-config.php, to be accessed via the src parameter found in the ~/admin/vendor/datatables/examples/resources/examples.php file.","status":"published","published":"2021-12-14T15:50:17.051Z","modified":"2025-01-31T18:59:02.895Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"cna"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:33:09.175141Z"}],"euvd":[{"id":"EUVD-2021-25673","description":"The True Ranker plugin \u003c= 2.2.2 for WordPress allows arbitrary files, including sensitive configuration files such as wp-config.php, to be accessed via the src parameter found in the ~/admin/vendor/datatables/examples/resources/examples.php file.","status":"published","published":"2021-12-14T15:50:17Z","modified":"2025-01-31T18:59:02Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-03T00:04:07.748787Z"}],"ghsa":[{"id":"GHSA-2mm8-gjg2-whmx","title":"The True Ranker plugin \u003c= 2.2.2 for WordPress allows arbitrary files, including sensitive...","description":"The True Ranker plugin \u003c= 2.2.2 for WordPress allows arbitrary files, including sensitive configuration files such as wp-config.php, to be accessed via the src parameter found in the ~/admin/vendor/datatables/examples/resources/examples.php file.","status":"published","published":"2021-12-15T00:00:56Z","modified":"2023-02-01T05:06:47Z","cwes":["CWE-22"],"updated_at":"2026-11-02T14:50:25.046492Z"}],"nvd":[{"id":"CVE-2021-39312","description":"The True Ranker plugin \u003c= 2.2.2 for WordPress allows arbitrary files, including sensitive configuration files such as wp-config.php, to be accessed via the src parameter found in the ~/admin/vendor/datatables/examples/resources/examples.php file.","status":"published","published":"2021-12-14T16:15:08.597Z","modified":"2026-06-17T04:03:31.56Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"secondary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:07:02.189991Z"}]}}