CVE-2023-0156

Deeper analysis

The All-In-One Security (AIOS) WordPress plugin before version 5.1.5 is affected by a path traversal vulnerability (CWE-22). The plugin fails to restrict which log files can be selected for display on its settings pages, enabling an authenticated administrator to read the final 50 lines of arbitrary files and enumerate directories anywhere on the underlying server that the web service account can access. The issue received a CVSS 3.1 score of 4.9.

An attacker with administrative privileges can exploit the flaw over the network to disclose sensitive configuration files, application source, or other readable content stored on the host. Because the plugin performs no path sanitization or allow-listing, the attacker can traverse outside the intended log directory and obtain information that would normally be inaccessible through the WordPress administrative interface.

The vulnerability was publicly documented by WPScan, which identifies the affected plugin versions and confirms the arbitrary file-read behavior. Upgrading to AIOS 5.1.5 or later removes the unrestricted file-selection capability. The associated EPSS score rose from lower values to a peak of 0.5597 on 2026-02-04 before receding to the current 0.3488, indicating a noticeable increase in exploitation interest after disclosure.