Vulnerability Description
WordPress Plugin ad manager wd 1.0.11 contains an arbitrary file download vulnerability that allows unauthenticated attackers to download sensitive files by manipulating the path parameter. Attackers can send GET requests to the edit.php endpoint with export=export_csv and a malicious path parameter to read arbitrary files like wp-config.php accessible to the web server.
CVSS Score
CRITICAL
Related Weaknesses (CWE)
References
- https://web-dorado.com/products/wordpress-ad-manager-wd.html
- https://www.exploit-db.com/exploits/46252
- https://www.vulncheck.com/advisories/wordpress-plugin-ad-manager-wd-arbitrary-fi
FAQ
What is CVE-2019-25727?
CVE-2019-25727 is a vulnerability with a CVSS score of 9.8 (CRITICAL). WordPress Plugin ad manager wd 1.0.11 contains an arbitrary file download vulnerability that allows unauthenticated attackers to download sensitive files by manipulating the path parameter. Attackers ...
How severe is CVE-2019-25727?
CVE-2019-25727 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2019-25727?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.