CVE-2018-9118

EPSS 48.2%◆ VulnCheck KEV

Vexday Risk Score

72High priority

SSVC decision (CISA)

Act

Exploitation + impact → act immediately

Exploit maturity

Functional exploit

Automatable exploit available (Nuclei/Metasploit).

CVSS —EPSS 48.2%KEV nãoPoC públicaNuclei simMetasploit —Patch —

Lifecycle

09 Apr 2018Public PoC

12 Apr 2018Published on NVD

Recommendation: Patch as soon as possible — active exploitation confirmed.

exports/download.php in the 99 Robots WP Background Takeover Advertisements plugin before 4.1.5 for WordPress has Directory Traversal via a .. in the filename parameter.

Affected products

n/a · n/a

public PoCs found — 2

cve_referencewww.exploit-db.com/exploits/44417/unverified exploitdbwww.exploit-db.com/exploits/44417unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

References

https://99robots.com/docs/wp-background-takeover-advertisements/https://wpvulndb.com/vulnerabilities/9056 https://www.exploit-db.com/exploits/44417/