PT-2025-37128 · WordPress · Propovoice: All-In-One Client Management System

Michael Mazzolini · Published 2025-09-11 · Updated 2025-09-16 · CVE-2025-8422

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Propovoice: All-in-One Client Management System plugin for WordPress versions through 1.7.6.7

Description The Propovoice: All-in-One Client Management System plugin for WordPress is susceptible to an arbitrary file read issue. This allows unauthenticated attackers to read the contents of arbitrary files on the server, potentially exposing sensitive information. The vulnerability resides within the send email() function.

Recommendations Update Propovoice: All-in-One Client Management System plugin for WordPress to a version later than 1.7.6.7.

Fix

Weakness Enumeration

CWE-73

Related Identifiers

CVE-2025-8422

Affected Products

Propovoice: All-In-One Client Management System

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2025-8422 · Security Note
• https://plugins.trac.wordpress.org/changeset/3361482/propovoice/trunk/includes/Api/Type/Email.php · Note
• https://twitter.com/cracbot/status/1967906346260381982 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/3ac72d7a-9540-435f-93cb-fdd4104b18f7?source=cve · Note
• https://plugins.trac.wordpress.org/browser/propovoice/trunk/includes/Api/Type/Email.php#L275 · Note