CVE-2015-4694

This vulnerability is like a “download” button that’s supposed to fetch only the zip attachment you requested, but instead lets someone trick the server into serving other files on your site. If an attacker finds the right trick, they can pull sensitive files off your server without logging in.

This matters if you run a WordPress site with the “Zip Attachments” plugin enabled. It’s a risk even without any login, and it’s reachable in the default setup when the vulnerable plugin version (< 1.5.1) is installed.

This is only a risk if your site is running Zip Attachments before 1.5.1 and the plugin’s download feature is accessible over the network.

Treat this as a real, fixable exposure: the weakness allows unauthenticated attackers to read arbitrary server files, and there are public exploits available. Because it’s network-reachable in default configuration and requires no user action, you should update promptly.

With an AMBER severity, aim to remediate as soon as possible rather than waiting for a routine maintenance window.

Confirm exposure

• In WordPress Admin, go to Plugins and find Zip Attachments.
• Record the installed version.
• This issue applies to Zip Attachments plugin versions earlier than 1.5.1.

Upgrade / fix

• Upgrade Zip Attachments to 1.5.1 or later.
• Use the official WordPress plugin update mechanism if available, or download the updated version from the vendor changelog/resources.
• After upgrading, test that zip attachment downloads still work correctly.

Temporary workaround (if you can’t patch immediately)

• Disable or uninstall the Zip Attachments plugin until you can upgrade to 1.5.1+, since the vulnerable endpoint is in the plugin’s download.php.
• If your organization needs the feature urgently, prioritize patching over configuration changes; the safest short-term mitigation is removing access to the vulnerable plugin.

What to monitor

• Check WordPress/plugin and web server logs for unusual requests to the plugin’s download behavior (the vulnerable functionality is in download.php with the za_file parameter).
• Look for repeated errors or requests with odd path-like values in the query string.

KEV / exploitation notes

• This CVE is not listed in CISA KEV, but public exploits exist and press attention is rising. That combination strongly suggests attackers may already be scanning for vulnerable sites.

CVE-2015-4694 is a directory traversal issue (CWE-22) in the Zip Attachments plugin’s download.php. An attacker can exploit it over the network without authentication by supplying a crafted value in the za_file parameter that includes path traversal sequences, enabling reading of arbitrary files on the web server.

Findings indicate: reads arbitrary files, no authentication required, no user interaction required, reachable in default configuration. Public exploits are available, suggesting practical attack capability. No KEV listing was provided, so KEV-confirmed exploitation is not established from the supplied findings. Patch guidance is available via the vendor changelog.

Verdict: AMBER (high enough impact due to file disclosure, but not categorized as fully confirmed KEV in the provided data).