Shadowserver Sees Exploitation of TinyMCE Thumbnail Gallery Path Traversal Bug Affecting WordPress Sites

The TinyMCE Thumbnail Gallery plugin for WordPress contains a high-severity path traversal vulnerability in versions before 1.1.0. This flaw enables unauthenticated attackers to access sensitive files on the server by manipulating specific URL parameters.

What happened

The National Vulnerability Database lists CVE-2012-20002 as a high-severity issue with a CVSS score of 8.7. The flaw stems from CWE-22, which relates to path traversal weaknesses. In the TinyMCE Thumbnail Gallery plugin, the `href` parameter in the `download-image.php` script fails to properly sanitize user input. Attackers can append traversal sequences, such as `../../`, to this parameter.

This manipulation allows malicious actors to traverse directory structures beyond the intended plugin folder. By crafting specific GET requests, they can retrieve arbitrary files from the web server. The Shadowserver Foundation first detected active exploitation of this vulnerability on October 19, 2023. These observations confirm that the flaw is not just theoretical but is being targeted in the wild.

Why it matters

The primary risk is the exposure of sensitive configuration files. Attackers can target `wp-config.php`, which typically contains database credentials and other critical secrets. Gaining access to these credentials can lead to full database compromise. This incident mirrors other high-severity path traversal issues reported recently, such as the SvelteKit preview server flaw and the Dulwich library bug, both of which affected Windows systems.

As Patch Gazette reported on October 21, 2026, similar path traversal vulnerabilities in SvelteKit and Dulwich allowed attackers to read or write files outside intended directories. While those affected different software stacks, the underlying mechanism of directory traversal remains a persistent threat. The ability to steal database credentials from WordPress sites can serve as a stepping stone for further attacks, including data exfiltration or remote code execution if other vulnerabilities are present.

What to watch

• Monitor web server logs for unusual GET requests to `download-image.php`.
• Look for query parameters containing multiple `../` sequences.
• Check for access attempts to sensitive files like `wp-config.php`.
• Review authentication logs for unauthorized access to database credentials.

Who needs to act first

Teams should prioritize updating WordPress sites that have the TinyMCE Thumbnail Gallery plugin installed. Exposure assessment is critical; identify which public-facing sites use this specific plugin version. Before applying the update, create a full backup of the site and database to ensure rollback capability. Test the update in a staging environment first to verify compatibility with other plugins and themes. If immediate patching is not possible, consider restricting access to the `download-image.php` file via web server rules or a web application firewall to mitigate exposure while a fix is prepared.

Background: CVSS score

The CVSS score explains vulnerability severity using a 0.0 to 10.0 scale. It measures attack vector, complexity, privileges required, and impact on confidentiality, integrity, and availability. You use this metric to prioritize patches, though you must adjust it for your specific environment to avoid wasting time on irrelevant threats.

Read the full guide: CVSS Score Explained: How to Read Risk Metrics and Prioritize Fixes

What to do and how to stay safe: WordPress

• Verify if your WordPress installation uses the TinyMCE Thumbnail Gallery plugin and check its version number.
• If running a version prior to 1.1.0, update to the latest version immediately to patch the path traversal flaw.
• Review server logs for signs of exploitation, such as requests containing directory traversal sequences.
• Once the vendor provides an update, apply it to all affected environments after testing in a non-production setting.

Step-by-step guide: Virtual Patching Myths: What It Actually Fixes and Breaks

General security guidance from the Patch Gazette newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which versions of TinyMCE Thumbnail Gallery are affected?

All versions before 1.1.0 are vulnerable to the path traversal flaw described in CVE-2012-20002.

Is there evidence that this vulnerability is being exploited?

Yes, the Shadowserver Foundation observed exploitation attempts starting on October 19, 2023.

What files can attackers access through this vulnerability?

Attackers can read arbitrary files, including sensitive configuration files like wp-config.php.