CVE-2015-5469

Public exploit available. Not confirmed exploited in the wild yet. No fix published yet.

CVSS 3.07.5High EPSS percentile96th10% chance in 30 days CISA KEVNot listedNo confirmed exploitation
Public exploit: 2 sources FixNone yetNo fix or workaround published

Published 2017-05-23Updated 2026-05-13Sources: CVE.org, NVD

NVD CVE.org

What to do

No fixed build or workaround is published yet. Limit exposure and watch for a patch.

Steps

Written by AI from the record

Check whether your WordPress site has MDC YouTube Downloader installed and whether it is version 2.1.0.
Disable and remove the plugin, or block public access to its download feature, until the vendor provides guidance.
There is no confirmed fixed version available; do not treat an upgrade as a complete fix unless the vendor explicitly confirms it addresses CVE-2015-5469.

May need vendor or contractor work

Check it yourselfA free Nuclei and OpenVAS check exists for this CVE. Run it against your hosts.Is your organisation exposed?Discuss checks for your systems with a specialist. Scope is agreed before testing.

What it is

From the CVE record

Absolute path traversal vulnerability in the MDC YouTube Downloader plugin 2.1.0 for WordPress allows remote attackers to read arbitrary files via a full pathname in the file parameter to includes/download.php.

In plain language

Written by AI from the record

MDC YouTube Downloader version 2.1.0 lets anyone online read files from your WordPress server, so businesses using it should act now.

Unauthenticated network-based arbitrary file read (CWE-22) in MDC YouTube Downloader 2.1.0 via an absolute pathname supplied to the file parameter in includes/download.php.

If you're affected

Server file exposure
WordPress configuration exposure
Database credential exposure
Customer data exposure

What is it

This flaw can let a stranger ask the website for a file stored elsewhere on its server and receive its contents. It is like a customer being able to give a shop clerk any back-room shelf location and being handed whatever is stored there, including keys or private records.

Who is affected

This matters to you if you run a WordPress site using MDC YouTube Downloader version 2.1.0. An attacker does not need an account or a staff member to click anything; the risk exists when the affected download feature is reachable from the internet.

How urgent is it

Attackers can use publicly available exploit code to request sensitive server files, so prioritize containment within days. No confirmed active exploitation is reported and the vulnerability is not listed in CISA's known-exploited catalog, but the lack of a confirmed fix keeps this an active risk.

What to do — in detail

Inventory WordPress installations and confirm whether MDC YouTube Downloader 2.1.0 is present; inspect whether includes/download.php can be reached from the public internet.
Treat version 2.1.0 as exposed. No vendor-confirmed fixed version or supported upgrade path is available from the findings.
If removal is not immediately possible, disable the plugin and restrict public access to the affected download endpoint at the web-server or web-application-firewall layer.
Review web-server access logs for unusual requests to includes/download.php, especially requests whose file parameter contains absolute server paths, and investigate any exposed configuration or credential files.
There is no CISA KEV remediation due date because CVE-2015-5469 is not listed in KEV. Monitor the plugin vendor for a confirmed replacement or fix before re-enabling the feature.

Technical context

CVSS 7.5 High: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. The issue is CWE-22 absolute path traversal/arbitrary file read: a remote unauthenticated request can provide a full pathname through the file parameter to includes/download.php. Two public exploits are known. CISA KEV does not list this CVE. EPSS is 10.1% (95th percentile) and falling; this is a prediction, not confirmation of exploitation in the wild.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS96th

Public exploit

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

2 sources with a proof of concept or module.

Exploit links, PoCs and Metasploit modules after sign-in

EPSS

10% chance of exploitation activity in the next 30 days, which ranks it in the 96th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

24 events over 3409 days, from the signal feeds we watch.

2026-09-22EPSS band changelow → moderateepss band change
2026-09-21EPSS band changemoderate → lowepss band change
2026-09-06EPSS band change0 → moderateepss band change
2026-09-05EPSS band changemoderate → 0epss band change
2026-08-31EPSS band change0 → moderateepss band change
2026-08-29EPSS band changemoderate → low

Affected products

mdc youtube downloader projectoss-project
- mdc youtube downloaderOn-premConsumer Software / file-utility

And 1 more affected product. See all after sign-in

Technical detail

CVSS 3.0 vector

Open in the CVSS calculator

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Scored 7.5 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity NoneNo integrity impact
Availability NoneNo availability impact