CVE-2019-25215

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2019-25215
The ARI-Adminer plugin for WordPress is vulnerable to authorization bypass due to a lack of file access controls in nearly every file of the plugin in versions up to, and including, 1.1.14. This makes it possible for unauthenticated attackers to call the files directly and perform a wide variety of unauthorized actions such as accessing a site's database and making changes.

7.3 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact LOW

Scope UNCHANGED

References
Link Resource
https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2065317%40ari-adminer&new=2065317%40ari-adminer&sfp_email=&sfph_mail= Patch
https://www.wordfence.com/threat-intel/vulnerabilities/id/67ad04d4-49ef-4bc4-b3b0-f2752566145e?source=cve Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:ari-soft:ari_adminer:*:*:*:*:*:wordpress:*:*
History

23 Dec 2025, 18:05

Type Values Removed Values Added
CPE cpe:2.3:a:ari-soft:ari_adminer:*:*:*:*:*:wordpress:*:*
First Time Ari-soft
Ari-soft ari Adminer
References () https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2065317%40ari-adminer&new=2065317%40ari-adminer&sfp_email=&sfph_mail= - () https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2065317%40ari-adminer&new=2065317%40ari-adminer&sfp_email=&sfph_mail= - Patch
References () https://www.wordfence.com/threat-intel/vulnerabilities/id/67ad04d4-49ef-4bc4-b3b0-f2752566145e?source=cve - () https://www.wordfence.com/threat-intel/vulnerabilities/id/67ad04d4-49ef-4bc4-b3b0-f2752566145e?source=cve - Third Party Advisory

16 Oct 2024, 16:38

Type Values Removed Values Added
Summary
  • (es) El complemento ARI-Adminer para WordPress es vulnerable a la omisión de autorización debido a la falta de controles de acceso a archivos en casi todos los archivos del complemento en las versiones hasta la 1.1.14 incluida. Esto permite que atacantes no autenticados accedan a los archivos directamente y realicen una amplia variedad de acciones no autorizadas, como acceder a la base de datos de un sitio y realizar cambios.

16 Oct 2024, 07:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-10-16 07:15

Updated : 2025-12-23 18:05

NVD link : CVE-2019-25215

Mitre link : CVE-2019-25215

CVE.ORG link : CVE-2019-25215

JSON object : View

Products Affected

ari-soft

  • ari_adminer
CWE
CWE-862

Missing Authorization