CVE-2012-6651: Multiple directory traversal vulnerabilities in the Vitamin plugin before 1.1.0 for WordPress allow remote...

Security readout for executives and security teams

This CVE affects the WordPress Vitamin plugin before 1.1.0. A remote attacker could abuse directory traversal handling to read arbitrary files from the server. For executives, the main concern is sensitive file disclosure, such as configuration data, if any public site still runs the vulnerable plugin. Exposure is likely limited to WordPress installations running the Vitamin plugin before 1.1.0, especially where the affected plugin PHP files remain publicly reachable. The source bundle does not provide install counts, affected CPEs, or current support status. Prioritize remediation for internet-facing WordPress sites that still run Vitamin before 1.1.0. The vulnerability is old and not KEV-listed in the provided bundle, but arbitrary file read can expose secrets and enable follow-on compromise. Mitigation focus: Identify whether any WordPress sites use the Vitamin plugin.; Upgrade Vitamin to version 1.1.0 or later where available.; Remove the plugin if it is unused or cannot be updated..

Prepared

Jun 14, 2026, 07:14 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.