SECURITYHIGHCVE-2012-20002

CVE-2012-20002: TinyMCE Thumbnail Gallery WordPress Plugin Path Traversal

The TinyMCE Thumbnail Gallery plugin before 1.1.0 lets unauthenticated attackers read arbitrary files such as wp-config.php through download-image.php.

Dylan H.

Security Team

October 21, 2026
2 min read
CVE-2012-20002: TinyMCE Thumbnail Gallery WordPress Plugin Path Traversal

Affected Products

  • TinyMCE Thumbnail Gallery plugin for WordPress before 1.1.0

CVE-2012-20002: Unauthenticated Arbitrary File Read in TinyMCE Thumbnail Gallery

A path traversal vulnerability, tracked as CVE-2012-20002 (CVSS 7.5, High), affects the TinyMCE Thumbnail Gallery plugin for WordPress before version 1.1.0. It was published to the NVD on October 20, 2026, despite the 2012 identifier.

Vulnerability Overview

AttributeValue
CVE IDCVE-2012-20002
CVSS Score7.5 (High)
TypePath traversal / arbitrary file read
Affected ProductTinyMCE Thumbnail Gallery plugin before 1.1.0
AuthenticationNone required
Vulnerable Endpoint/php/download-image.php, href parameter
Fixed Version1.1.0

How It Works

An unauthenticated attacker sends a GET request to /php/download-image.php with traversal sequences in the href parameter, for example pointing at ../../../../wp-config.php. The plugin returns the contents of the requested file.

Reading wp-config.php exposes database credentials and authentication keys and salts, which can lead to full site compromise.

Remediation

  1. Update the plugin to 1.1.0 or later, or remove it if unused (it is very old)
  2. Block requests to /php/download-image.php at the web server or WAF
  3. If the plugin was exposed, rotate database credentials and WordPress salts in wp-config.php
  4. Review web logs for GET requests to download-image.php containing ../

Key Takeaways

  1. Unauthenticated arbitrary file read in an abandoned-style WordPress plugin
  2. Fixed in version 1.1.0; remove the plugin if it is not needed
  3. Assume secrets in wp-config.php are compromised if the endpoint was reachable

Sources