PT-2025-35869 · WordPress · Easy Timer

Jonas Benjamin Friedli · CVE-2025-9519 · Publicado 2025-09-04 · Atualizado 2025-09-04

Positive Technologies (AI Summary)

CVSS v3.1

7.2

Alta

Vetor base

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Easy Timer plugin for WordPress versions prior to 4.2.2

Description The Easy Timer plugin for WordPress is susceptible to Remote Code Execution through its shortcodes. This is caused by inadequate restriction of shortcode attributes, potentially allowing authenticated attackers with Editor-level access or higher to execute code on the server.

Recommendations Update the Easy Timer plugin to version 4.2.2 or later.

Correção

RCE

Code Injection

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

CVE-2025-9519

Produtos afetados

Easy Timer

Referências · 6

• https://wordfence.com/threat-intel/vulnerabilities/id/9f2d8a68-4cb9-44bc-b4ae-43a8e8468634?source=cve · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2025-9519 · Nota de Segurança
• https://plugins.trac.wordpress.org/browser/easy-timer/trunk/shortcodes.php · Nota
• https://twitter.com/VulmonFeeds/status/1963605061726011399 · Publicação no Twitter
• https://twitter.com/CVEnew/status/1963462539024433608 · Publicação no Twitter
• https://plugins.trac.wordpress.org/changeset/3355111 · Nota