CVE-2011-1669

Name of the Vulnerable Software and Affected Versions WP Custom Pages module version 0.5.0.1 for WordPress

Description The issue allows remote attackers to read arbitrary files due to a directory traversal vulnerability in the wp-download.php file. This is achieved by using ..%2F (encoded dot dot) sequences in the url parameter.

Recommendations For WP Custom Pages module version 0.5.0.1, consider restricting access to the wp-download.php file until a patch is available. As a temporary workaround, avoid using the url parameter in the affected API endpoint until the issue is resolved.