{"id":"CVE-2026-77193","aliases":["EUVD-2026-85815","GHSA-px6q-rh8c-fgq2"],"status":"published","title":"eesy_ID2WP – Publish InDesign HTML5 \u003c= 1.0.3 - Unauthenticated Path Traversal to Arbitrary File Read via 'id2wp_path' Query Parameter","description":"The eesy_ID2WP – Publish InDesign HTML5 plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.0.3 via the `id2wp_path` parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00364,"percentile":0.30633,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-22"],"published":"2026-09-24T08:27:31Z","modified":"2026-09-24T14:40:36Z","products":[{"vendor":"eesywp","product":"eesy_id2wp – publish indesign html5"}],"references":[{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ad266e0f-fc69-4550-b89c-c32ce1221ee4?source=cve"},{"url":"https://plugins.trac.wordpress.org/changeset/3662793/"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-77193"},{"url":"https://plugins.trac.wordpress.org/changeset/3662793"},{"url":"https://github.com/advisories/GHSA-px6q-rh8c-fgq2"}],"sources":{"cve":[{"id":"CVE-2026-77193","title":"eesy_ID2WP – Publish InDesign HTML5 \u003c= 1.0.3 - Unauthenticated Path Traversal to Arbitrary File Read via 'id2wp_path' Query Parameter","description":"The eesy_ID2WP – Publish InDesign HTML5 plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.0.3 via the `id2wp_path` parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information.","status":"published","published":"2026-09-24T08:27:31.592Z","modified":"2026-09-24T12:55:42.051Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"cna"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:20:16.072351Z"}],"euvd":[{"id":"EUVD-2026-85815","description":"The eesy_ID2WP – Publish InDesign HTML5 plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.0.3 via the `id2wp_path` parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information.","status":"published","published":"2026-09-24T08:27:31Z","modified":"2026-09-24T12:55:42Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T17:27:59.466335Z"}],"ghsa":[{"id":"GHSA-px6q-rh8c-fgq2","title":"The eesy_ID2WP – Publish InDesign HTML5 plugin for WordPress is vulnerable to Path Traversal in...","description":"The eesy_ID2WP – Publish InDesign HTML5 plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.0.3 via the `id2wp_path` parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information.","status":"published","published":"2026-09-24T09:31:51Z","modified":"2026-09-24T09:32:00Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T15:12:22.2852Z"}],"nvd":[{"id":"CVE-2026-77193","description":"The eesy_ID2WP – Publish InDesign HTML5 plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.0.3 via the `id2wp_path` parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information.","status":"published","published":"2026-09-24T09:17:07.877Z","modified":"2026-09-24T14:40:36.103Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"secondary"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:12:51.036099Z"}]}}