CVE-2019-25727
The WordPress Plugin ad manager wd 1.0.11 has a flaw that lets anyone on the internet download any file the web server can read. By sending a crafted request to the plugin’s edit.php page, an attacker can retrieve sensitive files such as wp-config.php. The vulnerability is critical because it requires no authentication and can expose the entire site’s configuration.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
WordPress Plugin ad manager wd version 1.0.11
Real-world impact
An attacker can read arbitrary files on the server, including configuration files that contain database credentials and other secrets, potentially leading to full site compromise.
Why this severity
The CVSS score of 9.3 reflects that the flaw is exploitable over the network without authentication, and it gives the attacker complete confidentiality, integrity, and availability impact on the affected files. The vector shows no need for user interaction or privileges, making it highly dangerous.
What to do about it
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
No fix documented in sources
Timeline
- Jun 4, 2026 · Jun 4, 2026PublishedDisclosed and added to the National Vulnerability Database.
- Jul 22, 2026 · 13d agoAdvisory updatedThe NVD record was last revised.