CVE-2019-25727CWE-22

WordPress Plugin ad manager wd 1.0.11 Arbitrary File Download

Critical · published June 4, 2026

CVSS v4.0
9.3
EPSS
0%
Percentile
39.0
In the wild
Unconfirmed
What it is

WordPress Plugin ad manager wd 1.0.11 contains an arbitrary file download vulnerability that allows unauthenticated attackers to download sensitive files by manipulating the path parameter. Attackers can send GET requests to the edit.php endpoint with export=export_csv and a malicious path parameter to read arbitrary files like wp-config.php accessible to the web server.

The record
Technical detail
CVSS v4.0
9.3 · CRITICAL
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00460 · 39.0th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2026-06-04T13:22Z
EPSS history
Timeline
  • 04 JUN 13:22Z
    WordPress Plugin ad manager wd 1.0.11 Arbitrary File Download
    cvelistv5