Unauthenticated Arbitrary File Read Vulnerability Affects Advanced Access Manager Plugin

CVE-2019-25213

Summary

The Advanced Access Manager plugin for WordPress features a vulnerability that enables unauthenticated attackers to perform arbitrary file read operations. This issue arises from inadequate validation of user input in the aam-media parameter. Exploiting this vulnerability allows malicious entities to access sensitive files on the server, such as wp-config.php, which can contain critical configuration details. Webmasters using this plugin should take immediate action to update to a secure version, ensuring their site remains protected from potential data leaks that could compromise user data and overall security.

References