Google Drive for WordPress Path Traversal Allows Unauthenticated File Read
The National Vulnerability Database reports CVE-2018-25326, a high-severity path traversal vulnerability in Google Drive for WordPress plugin version 2.2. This flaw enables unauthenticated attackers to read arbitrary files on affected WordPress installations. By injecting directory traversal sequences into the file_name parameter of a POST request to gdrive-ajaxs.php, specifically when ajaxstype is set to del_fl_bkp, attackers can bypass directory restrictions.
This vulnerability, with a CVSSv3.1 score of 7.5 (HIGH), provides attackers with direct access to sensitive configuration files like wp-config.php. Such access can expose database credentials, API keys, and other critical information, leading to full compromise of the WordPress site. The attack vector is network-based with low attack complexity and requires no privileges or user interaction, making it a significant threat for vulnerable deployments.
While the National Vulnerability Database does not specify affected products beyond version 2.2, defenders should assume any Google Drive for WordPress installations running this version or older are at risk. The direct exposure of critical files makes this a prime target for initial access and privilege escalation. Patching or removing the vulnerable plugin is paramount to prevent exploitation.
What This Means For You
- If your organization uses the Google Drive for WordPress plugin, specifically version 2.2 or earlier, you are exposed. Immediately audit your WordPress installations to identify and patch or remove this vulnerable plugin. Assume compromise if you find unpatched instances and initiate incident response procedures to check for unauthorized file access, especially targeting `wp-config.php`.
Related ATT&CK Techniques
🛡️ Detection Rules
2 rules · 6 SIEM formats2 detection rules auto-generated for this incident, mapped to MITRE ATT&CK. Sigma YAML is free — export to any SIEM format via the Intel Bot.
CVE-2018-25326 - Google Drive for WordPress Unauthenticated File Read
title: CVE-2018-25326 - Google Drive for WordPress Unauthenticated File Read
id: scw-2026-05-17-ai-1
status: experimental
level: high
description: |
This rule detects attempts to exploit CVE-2018-25326 in the Google Drive for WordPress plugin. It specifically looks for POST requests to 'admin-ajax.php' with the 'action' parameter set to 'gdrive-ajaxs', the 'ajaxstype' parameter set to 'del_fl_bkp', and the 'file_name' parameter containing directory traversal sequences targeting sensitive files like 'wp-config.php'. This indicates an unauthenticated attacker attempting to read arbitrary files.
author: SCW Feed Engine (AI-generated)
date: 2026-05-17
references:
- https://shimiscyberworld.com/posts/nvd-CVE-2018-25326/
tags:
- attack.initial_access
- attack.t1190
logsource:
category: webserver
detection:
selection:
cs-uri|contains:
- '/wp-admin/admin-ajax.php'
cs-method:
- 'POST'
cs-uri-query|contains:
- 'action=gdrive-ajaxs'
cs-uri-query|contains:
- 'ajaxstype=del_fl_bkp'
cs-uri-query|contains:
- 'file_name='
selection_file_name:
cs-uri-query|contains:
- '../../wp-config.php'
condition: selection AND selection_file_name
falsepositives:
- Legitimate administrative activity
Source: Shimi's Cyber World · License & reuse
Indicators of Compromise
| ID | Type | Indicator |
|---|---|---|
| CVE-2018-25326 | Path Traversal | Google Drive for WordPress plugin version 2.2 |
| CVE-2018-25326 | Path Traversal | Vulnerable file: gdrive-ajaxs.php |
| CVE-2018-25326 | Path Traversal | Vulnerable parameter: file_name |
| CVE-2018-25326 | Path Traversal | POST request to gdrive-ajaxs.php with ajaxstype=del_fl_bkp and file_name containing ../../ |
| CVE-2018-25326 | Information Disclosure | Arbitrary file read, e.g., wp-config.php |
Written by SCW Vulnerability Desk
Source & Attribution
| Source Platform | NVD |
| Channel | National Vulnerability Database |
| Published | May 17, 2026 at 16:16 UTC |
This content was AI-rewritten and enriched by Shimi's Cyber World based on the original source. All intellectual property rights remain with the original author.
Believe this infringes your rights? Submit a takedown request.
Related coverage
CVE-2026-20240 — Denial of Service
CVE-2026-20240 — In Splunk Enterprise versions below 10.2.2, 10.0.5, 9.4.11, and 9.3.12, and Splunk Cloud Platform versions below 10.4.2603.1, 10.3.2512.9, 10.2.2510.11, 10.1.2507.21, 10.0.2503.13, and 9.3.2411.129,...
Splunk Enterprise, Cloud Vulnerability Exposes Session Cookies, Sensitive Data
CVE-2026-20239 — In Splunk Enterprise versions below 10.2.2 and 10.0.5, and Splunk Cloud Platform versions below 10.3.2512.8, 10.2.2510.11, 10.1.2507.21, and 10.0.2503.13, a user with a...
CVE-2026-20238 — In Splunk AI Toolkit versions below 5.7.3, a low-privileged
CVE-2026-20238 — In Splunk AI Toolkit versions below 5.7.3, a low-privileged user that does not hold the 'admin' or 'power' roles could access confidential data...