CVE-2021-39312

What it actually does

CVE-2021-39312 is an unauthenticated path traversal / arbitrary file read vulnerability in the True Ranker WordPress plugin version 2.2.2 and earlier. The vulnerable file, `/wp-content/plugins/seo-local-rank/admin/vendor/datatables/examples/resources/examples.php`, accepts a `src` parameter and can be abused to read files outside the intended directory. Because the flaw requires no authentication or user interaction and affects confidentiality only, attackers can remotely retrieve sensitive local files such as `wp-config.php`, which often contains database credentials, authentication salts, and other WordPress secrets.

Why it matters to the business

Successful exploitation can expose sensitive WordPress configuration data, including database usernames and passwords, secret keys, and site-specific configuration values. That information can enable follow-on compromise of the WordPress database, administrator account takeover, content manipulation, malware injection, or broader hosting account compromise. The risk is elevated because exploitation is simple, remote, unauthenticated, and weaponized, and the EPSS score indicates a high likelihood of exploitation activity in the wild even though the vulnerability is not currently listed in CISA KEV.

How an attack unfolds

An attacker identifies a WordPress site running the True Ranker plugin and probes for the vulnerable DataTables example resource under the plugin directory. The attacker then sends a crafted HTTP request to `examples.php` with a `src` value that uses directory traversal sequences to reference files outside the plugin path. If the vulnerable plugin is present and access is not blocked, the server returns the requested file contents. Attackers commonly target `wp-config.php` first because it contains database connection details and WordPress cryptographic salts. With those secrets, the attacker may attempt database access, password hash theft, creation of administrative users, session forgery attempts, or other post-exploitation activity depending on the hosting and database exposure.

How to fix it

Remove the True Ranker plugin if it is not required. If the plugin is required, upgrade to a version that contains a vendor fix; no fixed version was provided in the supplied advisory data, so administrators should verify the latest release from the WordPress plugin repository or vendor before redeployment. As an immediate mitigation, block direct web access to `/wp-content/plugins/seo-local-rank/admin/vendor/datatables/examples/resources/examples.php` and, more broadly, deny public access to unused vendor example/demo files under plugin directories. Rotate WordPress database credentials and authentication salts if exploitation is suspected or if the vulnerable endpoint was publicly exposed. Ensure the database is not internet-accessible and that its credentials are scoped to the minimum privileges required by WordPress.

How to confirm the fix worked

Confirm whether the True Ranker plugin is installed and determine its version from the WordPress admin interface, plugin metadata, filesystem, or software inventory. Sites running True Ranker version 2.2.2 or earlier should be considered vulnerable unless compensating controls block the affected endpoint. Validate remediation by confirming the plugin is removed or upgraded and that direct requests to `/wp-content/plugins/seo-local-rank/admin/vendor/datatables/examples/resources/examples.php` are blocked, return 403/404, or no longer process the `src` parameter. Review web server configuration to ensure plugin vendor example files are not publicly reachable. If secrets were exposed, validate that database passwords and WordPress salts have been rotated and that old credentials no longer work.

Typical attack path

1. Scan internet-facing WordPress sites for the True Ranker plugin path.
2. Request `/wp-content/plugins/seo-local-rank/admin/vendor/datatables/examples/resources/examples.php` to confirm the vulnerable file is reachable.
3. Submit a crafted `src` parameter containing path traversal sequences such as `../` to reach sensitive files.
4. Retrieve sensitive files, most notably `wp-config.php`.
5. Extract database credentials, WordPress salts, table prefix information, and other configuration values.
6. Use the exposed information for follow-on access attempts against the WordPress database, hosting environment, or WordPress administrator accounts.

How to detect it

Review HTTP access logs, WAF logs, CDN logs, reverse-proxy logs, and endpoint/web server logs for requests to the True Ranker plugin DataTables example endpoint. Focus on requests containing the vulnerable path and a `src` parameter with path traversal sequences or sensitive filename targets such as `wp-config.php`, `/etc/passwd`, or other local configuration files. Investigate successful HTTP 200 responses, unusually large response sizes, repeated traversal attempts, and requests from unfamiliar scanners or hosting providers. If exploitation is suspected, examine WordPress audit logs for new administrator users, password changes, plugin/theme modifications, and unexpected logins after the file-read event. Review database authentication logs for new or unusual connections using the WordPress database account, especially from IP addresses or hosts not normally used by the web server. Conduct filesystem integrity checks for modified PHP files, newly added web shells, and suspicious files under `wp-content/uploads`, plugin directories, and theme directories.

• /wp-content/plugins/seo-local-rank/admin/vendor/datatables/examples/resources/examples.php
• examples.php?src=
• src=../
• src=..%2f
• src=%2e%2e%2f
• src=..%252f
• src=%252e%252e%252f
• wp-config.php
• src=../../../../wp-config.php
• src=..%2f..%2f..%2f..%2fwp-config.php
• /etc/passwd
• src=../../../../etc/passwd
• GET /wp-content/plugins/seo-local-rank/admin/vendor/datatables/examples/resources/examples.php
• POST /wp-content/plugins/seo-local-rank/admin/vendor/datatables/examples/resources/examples.php
• wp-content/plugins/seo-local-rank/
• admin/vendor/datatables/examples/resources/examples.php

What your security team should do

• Prioritize internet-facing WordPress sites and asset inventories for True Ranker plugin detection because exploitation is weaponized and the EPSS likelihood is high.
• Remove the plugin where possible; otherwise upgrade to a verified fixed release or block access to the vulnerable `examples.php` endpoint.
• Search web access logs for requests to the vulnerable path and for `src` parameters containing traversal patterns such as `../`, `%2e%2e%2f`, or requests attempting to read `wp-config.php`.
• If suspicious access is found, treat WordPress database credentials and authentication salts as compromised and rotate them promptly.
• Check for follow-on compromise indicators, including newly created WordPress administrator accounts, unexpected plugin/theme file changes, web shells, database exports, or unusual database logins.
• Add WAF or reverse-proxy rules to block path traversal sequences targeting WordPress plugin paths, especially under `/wp-content/plugins/seo-local-rank/`.
• Harden WordPress by disabling direct access to vendor demo/example files, enforcing least-privilege database credentials, and maintaining continuous plugin inventory monitoring.