CVE-2018-16283

Unauthenticated directory traversal in wechat brodcast's Image.php `url` parameter allows remote arbitrary-file read on vulnerable WordPress installations.

If affected, business impact

Website configuration exposurePassword and key exposureCustomer data exposureFurther system compromise

What to do now

Check your WordPress Plugins list for wechat brodcast and confirm its version; version 1.2.0 or earlier is affected.
Disable and remove the plugin from affected sites until a verified replacement or vendor fix is available.
There is no verified fixed version currently available; do not rely on a routine update as remediation.
Ask your IT provider to check server logs for unusual requests to the plugin's image page and change exposed site or database passwords if suspicious activity is found.

May need vendor / contractor work

What is it

This flaw lets someone manipulate an image request so the website opens files it should keep private. It is like a stranger using a photo pickup window to reach into locked filing cabinets behind the counter.

Who is affected

This matters if your WordPress website uses wechat brodcast. An attacker does not need an account or anyone to click anything. The vulnerable image-request page must be reachable; whether it is reachable in a default setup is not yet known.

How urgent is it

Attackers can use publicly available exploit code to try to read sensitive files from affected sites. Treat this as red: remove or disable the affected plugin promptly and check for signs that it was targeted.

What to do — in detail

Confirm whether wechat brodcast is installed and whether the installed version is 1.2.0 or earlier. Review the web server configuration and access logs to determine whether the plugin's Image.php endpoint is internet-reachable, then search logs for requests containing that endpoint and a url parameter with directory-traversal patterns.

No vendor fixed version or supported upgrade path is available in the findings. Disable and remove the plugin; if removal must be delayed, block external access to its Image.php endpoint at the web server or web application firewall and restrict access to trusted administrators until removal is complete. Breaking-change information and a safe replacement are not yet known.

CISA has not added this CVE to its Known Exploited Vulnerabilities catalog, so there is no CISA remediation due date. Monitor for suspicious requests to Image.php, unexpected file-access errors, and signs that WordPress, database, or hosting credentials may have been exposed; rotate relevant credentials if exposure is suspected.

Technical context

CVE-2018-16283 is rated CVSS 3.0 9.8 Critical (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The weakness is CWE-22 directory traversal: a crafted url parameter to Image.php can permit unauthenticated arbitrary-file read over the network. One public exploit is known. EPSS is 63.1% (99th percentile) and falling. The CVE is not listed in CISA KEV; the findings do not confirm active exploitation in the wild.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.