CVE-2017-20287

HIGH 7.5

Javo Spot WordPress Theme < 3.0.0 Path Traversal via admin-ajax.php fn Parameter

CVSS Score

7.5

EPSS Score

0.0%

EPSS Percentile

0th

Javo Spot theme for WordPress before 3.0.0 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files via the fn parameter of the jvfrm_spot_get_json AJAX action. Attackers can send GET requests to /wp-admin/admin-ajax.php with fn set to ../../wp-config.php to retrieve database credentials and secret keys. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-19.

CWE	CWE-22
Vendor	javo themes
Product	javo spot
Published	Oct 22, 2026

Stay Ahead of the Next One

Get instant alerts for javo themes javo spot

Be the first to know when new high vulnerabilities affecting javo themes javo spot are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Affected Versions

Javo Themes / Javo Spot

0 < 3.0.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

codeseekah.com: https://codeseekah.com/2017/02/09/javo-themes-spot-lfi-vulnerability/ wpscan.com: https://wpscan.com/vulnerability/2d465fc4-d4fa-43bb-9c0d-71dcc3ee4eab github.com: https://github.com/projectdiscovery/nuclei-templates/blob/main/http/vulnerabilities/wordpress/wp-javospot-lfi.yaml themeforest.net: https://themeforest.net/item/javo-spot-multi-purpose-directory-wordpress-theme/13198068 vulncheck.com: https://www.vulncheck.com/advisories/javo-spot-wordpress-theme-3.0.0-path-traversal-via-admin-ajax-php-fn-parameter

Credits

soulseekah 🔍 The Shadowserver Foundation