No fixed build or workaround is published yet. Limit exposure and watch for a patch.
Steps
Written by AI from the record
Check whether your WordPress site has the JSmol2WP plugin installed and whether its version is 1.07.
If it is version 1.07, disable the plugin immediately (and remove it if you don’t need it).
Contact your plugin vendor/support or hosting provider to ask for a fixed version or remediation plan (no patch information is available from the findings).
Review your server and WordPress logs for suspicious requests to jsmol.php with unusual query parameters, and rotate any exposed credentials if you find signs of access.
An issue was discovered in the JSmol2WP plugin 1.07 for WordPress. There is an arbitrary file read vulnerability via ../ directory traversal in query=php://filter/resource= in the jsmol.php query string. This can also be used for SSRF.
In plain language
Written by AI from the record
CVE-2018-20463 is an open-to-the-internet issue in the JSmol2WP WordPress plugin 1.07 that can let an attacker read sensitive server files without a login; small businesses should take action because it’s reachable in default setups and no official fix was found.
Unauthenticated arbitrary file read (CWE-22) in JSmol2WP 1.07 via manipulation of the jsmol.php query parameter (directory traversal/“php://filter/resource=” style handling), enabling access to server files and potentially internal network resources (SSRF).
If you're affected
Sensitive files disclosure
Password or credential exposure
Customer data exposure
Operational disruption
What is it
This is a bug in a WordPress add-on that lets someone outside your business request and “peek at” files on your server without logging in. Think of it like leaving a storage room door unlocked—an attacker may be able to read documents they shouldn’t have. Depending on what’s accessible, that could include files containing secrets like API keys or other sensitive information.
Who is affected
This matters if you run WordPress with the JSmol2WP plugin version 1.07 installed. The findings indicate the issue is reachable over the network without any login and requires no user interaction, so an outside attacker doesn’t need to trick staff or customers.
It’s a risk when the vulnerable plugin is present and reachable on your site (i.e., the plugin is installed and the relevant feature/endpoint is accessible in your default setup).
How urgent is it
Treat this as urgent for the AMBER level: attackers can exploit it without a login by sending crafted requests over the network. The findings also indicate the issue is reachable in default configurations, which increases the chance of real-world targeting.
No official fix was identified in the provided sources, so disabling/removing the vulnerable plugin is the most reliable immediate step.
What to do — in detail
Confirm exposure
In WordPress admin, go to Plugins and identify whether “JSmol2WP” is installed.
Check the installed version; this issue applies to JSmol2WP version 1.07.
If you find version 1.07, assume you are exposed because the findings indicate the vulnerability is network-reachable and does not require authentication.
Check for suspicious activity (recommended even if you disable the plugin)
Search web server and WordPress logs for requests to the jsmol.php path.
Look for unusual query strings that resemble directory traversal patterns or attempts to use “php://filter/resource=” style inputs.
If you find indicators of exploitation, treat it as an incident: review what files may have been targeted and whether secrets could have been exposed.
Remediate now
Disable the JSmol2WP plugin immediately.
If you do not need it, uninstall it entirely.
Fix/patch follow-up
The findings report no fix/patch information available. Contact the plugin vendor/support or your hosting provider to obtain guidance on a fixed version or replacement.
If/when a patched version is released, upgrade as soon as possible.
If disabling isn’t possible right away
The practical mitigation is to remove or disable the vulnerable functionality because there is no confirmed vendor patch available from the provided sources.
If your organization must keep the plugin briefly, reduce exposure by limiting public access to the affected WordPress pages/endpoint (for example, via application/firewall rules) while you work with support to remove the vulnerable version.
After remediation
Re-check that the plugin is no longer present at version 1.07.
Continue monitoring logs for attempts against jsmol.php; attackers may keep probing after you patch.
Technical context
Severity and summary: The issue is rated as high (CVSS 7.5) and affects JSmol2WP for WordPress, version 1.07. The weakness is CWE-22 (path traversal).
Mechanism: The vulnerability allows unauthenticated attackers to read arbitrary files on the server by manipulating the query parameter handled by jsmol.php, involving directory traversal patterns and “php://filter/resource=” handling. The same behavior can also be leveraged to access internal network resources (SSRF).
Reachability: Findings state it is reachable in default configuration and does not require authentication or user interaction.
Exploitation status: A detection template exists, and press attention is rising. KEV is not listed, so exploitation-as-confirmed-by-KEV was not indicated in the provided sources.
Patch status: No fix/patch information was available in the provided sources.
Prediction note: EPSS is provided as a prediction, and per instructions it is not used as a public justification for action.
This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.
