On this page
Atomicorp WAF Rule 347006
Rule Summary
- Rule ID: 347006
- Status: Active
- Alert message: Atomicorp.com WAF Rules: Generic Path Recursion denied in URI/ARGS
- Observed CWEs: CWE-22 (15), CWE-26 (1), CWE-73 (2), CWE-98 (6), CWE-327 (1), CWE-352 (2), CWE-434 (2), CWE-552 (1), CWE-862 (2)
- Revision: 69
- Rule severity: Critical (2)
- Phase: 2 (request body)
- Request surfaces: Request filename, Request headers, Request arguments, JSON request data, SOAP request data
- Rule action: deny
- HTTP status: 403
- Logging: log, auditlog
Description
This rule detects behavior identified by its current alert as “Generic Path Recursion denied in URI/ARGS” in the request filename, request headers, request arguments, JSON request data, SOAP request data. It evaluates during the request body phase and denies matching traffic with HTTP status 403.
Selected Related CVEs
This is a selected list of documented research observations, not an exhaustive coverage matrix. Absence of a CVE does not imply absence of protection.
| CVE | Vulnerability | Product | CVSS | Severity |
|---|---|---|---|---|
| CVE-2020-24186 | WordPress wpDiscuz Unauthenticated File Upload Vulnerability | wpdiscuz | 10.0 (v3.1) | Critical |
| CVE-2023-5815 | News & Blog Designer Pack – WordPress Blog Plugin <= 3.4.1 - Unauthenticated Local File Inclusion | news & blog designer pack | 9.8 (v3.1) | Critical |
| CVE-2024-10571 | Chartify – WordPress Chart Plugin < 2.9.6 - Local File Inclusion | chartify | 9.8 (v3.1) | Critical |
| CVE-2024-6460 | WordPress Grow by Tradedoubler Plugin < 2.0.22 - Unauthenticated Local File Inclusion | tradedoubler-affiliate-tracker | 9.8 (v3.1) | Critical |
| CVE-2024-9193 | WHMpress <= 6.3-revision-0 - Unauthenticated Local File Inclusion to Arbitrary Options Update | whmcs | 9.8 (v3.1) | Critical |
| CVE-2025-6439 | WooCommerce Designer Pro <= 1.9.26 - Unauthenticated Arbitrary File Deletion | WooCommerce Designer Pro | 9.8 (v3.1) | Critical |
| CVE-2026-15896 | Super Forms <= 6.3.316 - Unauthenticated Path Traversal to Arbitrary File Read via 'sfgtfi' URL Path Parameter | Super Forms – Drag & Drop Form Builder | 9.1 (v3.1) | Critical |
| CVE-2018-12895 | Wordpress Arbitrary File Deletion | WordPress | 8.8 (v3.1) | High |
| CVE-2019-8942 | WordPress Crop-image Shell Upload | WordPress | 8.8 (v3.0) | High |
| CVE-2016-20103 | Cherry Plugin for WordPress < 1.2.7 Path Traversal via download-content.php | Cherry Plugin | 8.7 (v4.0) | High |
| CVE-2017-20287 | Javo Spot WordPress Theme < 3.0.0 Path Traversal via admin-ajax.php fn Parameter | Javo Spot | 8.7 (v4.0) | High |
| CVE-2026-11974 | Media folder Addon < 4.1.7 - Unauthenticated Arbitrary File Download | wp-media-folder-addon | 8.6 (v3.1) | High |
| CVE-2025-13322 | WP AUDIO GALLERY <= 2.0 - Authenticated (Subscriber+) Arbitrary File Deletion via 'audio_upload' Parameter | WP AUDIO GALLERY | 8.1 (v3.1) | High |
| CVE-2025-9990 | WordPress Helpdesk Integration <= 5.8.10 - Unauthenticated Local File Inclusion | WordPress Helpdesk Integration | 8.1 (v3.1) | High |
| CVE-2020-36836 | WordPress WP Fastest Cache <= 0.9.0.2 - Authenticated Arbitrary File Deletion | wp fastest cache | 8.0 (v3.1) | High |
| CVE-2025-14804 | Frontend File Manager < 23.5 - Subscriber+ Arbitrary File Deletion | Frontend File Manager Plugin | 7.7 (v3.1) | High |
| CVE-2020-11738 | WordPress Duplicator File Read Vulnerability | duplicator | 7.5 (v3.1) | High |
| CVE-2022-33901 | WordPress MultiSafepay for WooCommerce <=4.13.1 - Arbitrary File Read | multisafepay plugin for woocommerce | 7.5 (v3.1) | High |
| CVE-2025-2539 | File Away <= 3.9.9.0.1 - Missing Authorization to Unauthenticated Arbitrary File Read | file away | 7.5 (v3.1) | High |
| CVE-2026-10737 | SP Project & Document Manager <= 4.71 - Missing Authorization to Unauthenticated Arbitrary File Information Disclosure v | SP Project & Document Manager | 7.5 (v3.1) | High |
| CVE-2026-14490 | Demi <= 0.0.6 - Unauthenticated Arbitrary Directory Deletion via demi_restore_step AJAX action | Demi – One Click Demo Import, Backup & Site Migration | 7.5 (v3.1) | High |
| CVE-2025-12835 | WooMulti <= 1.7 - Subscriber+ Arbitrary File Deletion | WooMulti | 7.3 (v3.1) | High |
| CVE-2026-15244 | HUSKY - Products Filter Professional for WooCommerce < 1.4.1 - Shop Manager+ Local File Inclusion via meta_filter search | HUSKY | 7.2 (v3.1) | High |
| CVE-2025-11977 | HappyForms <= 1.26.12 - Authenticated (Admin+) Local File Inclusion | Happyforms – Form Builder for WordPress: Drag & Drop Contact Forms, Surveys, Payments & Multipurpose Forms | 6.6 (v3.1) | Medium |
| CVE-2026-14280 | Events Manager <= 7.3.7.4 - Authenticated (Administrator+) Local File Inclusion via 'dbem_data[updates]' Array Keys | Events Manager – Calendar, Bookings, Tickets, and more! | 6.6 (v3.1) | Medium |
| CVE-2015-9538 | WordPress NextGEN Gallery Directory Read Vulnerability | nextgen gallery | 6.5 (v3.1) | Medium |
| CVE-2016-6897 | WordPress Traversal Directory DoS | WordPress | 6.5 (v3.0) | Medium |
| CVE-2019-8943 | WordPress Crop-image Shell Upload | WordPress | 6.5 (v3.1) | Medium |
| CVE-2025-11705 | Anti-Malware Security and Brute-Force Firewall <= 4.23.81 - Missing Authorization to Authenticated (Subscriber+) Arbitra | Anti-Malware Security and Brute-Force Firewall | 6.5 (v3.1) | Medium |
| CVE-2025-13380 | AI Engine for WordPress: ChatGPT, GPT Content Generator <= 1.0.1 - Authenticated (Contributor+) Arbitrary File Read | AI Engine for WordPress: ChatGPT, GPT Content Generator | 6.5 (v3.1) | Medium |
| CVE-2025-13891 | Image Gallery – Photo Grid & Video Gallery (Modula) <= 2.13.3 - Missing Authorization to Arbitrary Directory Listing | Modula Image Gallery – Photo Grid & Video Gallery | 6.5 (v3.1) | Medium |
| CVE-2026-12898 | All-in-One WP Migration and Backup < 7.106 - Arbitrary Log File Write | all-in-one-wp-migration | 6.5 (v3.1) | Medium |
| CVE-2022-4320 | WordPress Events Calendar <1.4.5 - Cross-Site Scripting | wordpress events calendar plugin | 6.1 (v3.1) | Medium |
| CVE-2026-13693 | Bit Form < 3.1.0 - Unauthenticated Arbitrary File Read via Path Traversal | Bit Form | 5.9 (v3.1) | Medium |
| CVE-2026-9062 | WordPress Agile Store Locator < 1.6.9 - Arbitrary File Read | agile-store-locator | 3.4 (v3.1) | Low |
Observed CWEs
These CWEs are recorded on published CVEs in the selected observations associated with this rule. They are observational relationships, not a claim that the rule universally blocks every vulnerability assigned to a CWE.