Critical severity9.8NVD Advisory· Published Oct 16, 2024· Updated Jun 17, 2026

CVE-2019-25213

Description

The Advanced Access Manager plugin for WordPress is vulnerable to Unauthenticated Arbitrary File Read in versions up to, and including, 5.9.8.1 due to insufficient validation on the aam-media parameter. This allows unauthenticated attackers to read any file on the server, including sensitive files such as wp-config.php

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

WordPress/Advanced Access Managerllm-fuzzy
Range: <=5.9.8.1
Package: https://wordpress.org/plugins/advanced-access-manager
vasyltech/Advanced Access Manager – Access Governance for WordPressv5
Range: 0

Patches

Vulnerability mechanics

References

plugins.trac.wordpress.org/changeset/2098838/advanced-access-manager/trunk/application/Core/Media.phpnvdPatch
www.wordfence.com/threat-intel/vulnerabilities/id/55e0f0df-7be2-4e18-988c-2cc558768effnvdThird Party Advisory

News mentions

No linked articles in our index yet.

cvss	0.637
epss	0.002
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000