GCVE - cpe:2.3:a:cherry_team:cherry

Approved changes feed: RSS · Atom

cpe:2.3:a:cherry_team:cherry_plugin:*:*:*:*:*:*:*:*

part: a version: * update: *

Notes

Imported from gcve-enriched-dumps CVE data

PURL	Source	Last updated
No PURL mappings for this CPE yet.

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2016-20103`	vulnerable	2026-11-03 10:37:55.179659	Cherry Plugin for WordPress < 1.2.7 Path Traversal via download-content.php HIGH (7.5) Cherry Plugin for WordPress before 1.2.7 contains a path traversal vulnerability that allows unauthenticated attackers to download arbitrary files via the 'file' parameter. Attackers can send GET requests to /admin/import-export/download-content.php with traversal sequences like ../../../../../wp-config.php to read database credentials, since the script passes input directly to readfile(). Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-19. Published: 2026-10-20T20:31:28.909Z Updated: 2026-10-28T15:57:22.592Z Open on db.gcve.eu Reference links https://wpscan.com/vulnerability/90034817-dee7-40c9-80a2-1f1cd1d033ee https://github.com/CherryFramework/cherry-plugin/commit/69a3f7b https://github.com/projectdiscovery/nuclei-templates/blob/main/http/vulnerabilities/wordpress/cherry-file-download.yaml https://www.vulncheck.com/advisories/cherry-plugin-for-wordpress-1.2.7-path-traversal-via-download-content-php	Imported from gcve-enriched-dumps CVE data

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.

Inspect record JSON

Open this panel to browse, search, copy or download the JSON record.