Security readout for executives and security teams
Plain-English summary
CVE-2019-25727 is a critical issue in the WordPress Ad Manager WD plugin version 1.0.11. An unauthenticated attacker could use the vulnerable export/download behavior to read sensitive server files. For an affected WordPress site, this could expose configuration secrets and create follow-on compromise risk.
Executive priority
Prioritize this for immediate inventory and containment on public WordPress assets. The business risk is credential exposure leading to site takeover or broader infrastructure access. No active exploitation is confirmed in the provided sources, but public exploit information raises urgency.
Technical view
The source bundle describes a CWE-22 path traversal/arbitrary file download vulnerability in Ad Manager WD 1.0.11. The vulnerable behavior is reachable without authentication and can read files accessible to the web-server process. CVSS 3.1 is 9.8, reflecting network access, low complexity, no privileges, and high confidentiality, integrity, and availability impact.
Likely exposure
Exposure is limited to WordPress installations running the Ad Manager WD plugin version 1.0.11. Internet-facing WordPress sites have the most urgent risk. The bundle does not prove exposure for later versions or other Web-Dorado products.
Exploitation context
A public ExploitDB reference is listed, so exploit knowledge appears public. The CVE is not marked KEV, and the provided sources do not confirm active exploitation in the wild. Treat this as high urgency because unauthenticated file access can expose credentials.
Researcher notes
Evidence supports Ad Manager WD 1.0.11 as affected, with CWE-22 and CVSS 9.8. The bundle does not provide a confirmed fixed version, patch details, or KEV listing. Avoid assuming broader product impact without vendor or advisory confirmation.
Mitigation direction
- Inventory WordPress sites for Ad Manager WD installations.
- Remove or disable version 1.0.11 until vendor guidance confirms a safe version.
- Check the vendor homepage and VulnCheck advisory for remediation guidance.
- Rotate WordPress and database credentials if sensitive configuration exposure is suspected.
- Review backups and hosted files for secrets readable by the web server.
Validation and detection
- Confirm whether Ad Manager WD is installed on each WordPress site.
- Verify the installed plugin version, prioritizing version 1.0.11.
- Review web logs for unusual plugin export or file download activity.
- Assess whether sensitive configuration files were accessible to the web-server user.
- Document affected assets, status, and remediation decisions.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-22: File access and web shell behavior lookup
File traversal and upload weaknesses can lead teams to review file, web shell, execution, and collection telemetry. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupFile access behavior lookup
The CVE wording references file access or upload behavior, so file telemetry and web shell review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2019-25727 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
2 official scoresWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H3.95.9VulnCheckCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N——VulnCheckVulnerability scoring details
Base CVSS 4.0 score
9.3CriticalVector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Base CVSS 3.1 score
9.8CriticalVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- ExploitDB-46252CVE reference, VulnCheck · exploit
- Official Product HomepageCVE reference, VulnCheck · product
- VulnCheck Advisory: WordPress Plugin ad manager wd 1.0.11 Arbitrary File DownloadCVE reference, VulnCheck · third-party-advisory
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.