blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

← Back to CVE list

CVE-2019-25215

HIGH 7.3 CVSS 3.1
Published
October 16, 2024
Last modified
June 17, 2026
NVD status
Analyzed
Reported by
security@wordfence.com
Weakness
CWE-862
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Description

The ARI-Adminer plugin for WordPress is vulnerable to authorization bypass due to a lack of file access controls in nearly every file of the plugin in versions up to, and including, 1.1.14. This makes it possible for unauthenticated attackers to call the files directly and perform a wide variety of unauthorized actions such as accessing a site's database and making changes.

Affected products and versions

  • arisoft ARI Adminer – WordPress Database Manager — Up to and including 1.1.14
  • ari-soft ari_adminer — Up to and including 1.1.14

References

  • plugins.trac.wordpress.org https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2065317%40ari-adminer&new=2065317%40ari-adminer&sfp_email=&sfph_mail= Patch
  • www.wordfence.com https://www.wordfence.com/threat-intel/vulnerabilities/id/67ad04d4-49ef-4bc4-b3b0-f2752566145e?source=cve Third Party Advisory
  • nvd.nist.gov Official NVD record