PT-2025-35869 · WordPress · Easy Timer

Jonas Benjamin Friedli · Published 2025-09-04 · Updated 2025-09-04 · CVE-2025-9519

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Easy Timer plugin for WordPress versions prior to 4.2.2

Description The Easy Timer plugin for WordPress is susceptible to Remote Code Execution through its shortcodes. This is caused by inadequate restriction of shortcode attributes, potentially allowing authenticated attackers with Editor-level access or higher to execute code on the server.

Recommendations Update the Easy Timer plugin to version 4.2.2 or later.

Fix

RCE

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2025-9519

Affected Products

Easy Timer

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2025-9519 · Security Note
• https://wordfence.com/threat-intel/vulnerabilities/id/9f2d8a68-4cb9-44bc-b4ae-43a8e8468634?source=cve · Note
• https://plugins.trac.wordpress.org/browser/easy-timer/trunk/shortcodes.php · Note
• https://twitter.com/VulmonFeeds/status/1963605061726011399 · Twitter Post
• https://twitter.com/CVEnew/status/1963462539024433608 · Twitter Post
• https://plugins.trac.wordpress.org/changeset/3355111 · Note