Security readout for executives and security teams
Plain-English summary
This issue can expose WordPress user records from an Accio template migration file if that file remains publicly reachable. The disclosed data may include usernames, password values, and email addresses. No CVSS score or active exploitation evidence is provided in the source bundle.
Executive priority
Treat confirmed exposure as urgent because it may disclose WordPress account data. Prioritize internet-facing WordPress sites and any systems reusing those credentials.
Technical view
CVE-2015-9485 describes sensitive information disclosure in ThemeMakers Accio Responsive Parallax One Page Site Template through 2015-05-15 for WordPress via direct access to wp-content/uploads/tmm_db_migrate/wp_users.dat.
Likely exposure
Exposure is likely limited to WordPress sites that used the named Accio component and still have the migration data file publicly accessible under uploads.
Exploitation context
The source describes remote access by direct request to a known file path. KEV is false, and the supplied sources do not claim active exploitation.
Researcher notes
The record lacks CVSS, CWE, detailed affected CPEs, and vendor remediation data. Analysis is based on the CVE description and PacketStorm reference only.
Mitigation direction
- Check vendor or ThemeMakers guidance for any documented fix or cleanup procedure.
- Remove the exposed wp_users.dat file if it exists and is not required.
- Block public web access to the tmm_db_migrate directory.
- Rotate affected WordPress user passwords if exposure is confirmed.
- Review whether old migration artifacts remain under wp-content/uploads.
Validation and detection
- Inventory WordPress sites using the Accio template through 2015-05-15.
- Check whether wp-content/uploads/tmm_db_migrate/wp_users.dat exists on the server.
- Confirm the file is not publicly reachable over HTTP.
- Review web logs for requests to the disclosed file path.
- Assess exposed records to determine credential reset scope.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2015-9485 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://packetstormsecurity.com/files/131957/CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.