PT-2025-47707 · WordPress · 简数采集器

Published 2025-11-21 · Updated 2025-11-21 · CVE-2025-11973

Positive Technologies (AI Summary)

CVSS v3.1

4.9

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions 简数采集器 plugin for WordPress versions through 2.6.3

Description The 简数采集器 plugin for WordPress is susceptible to an issue allowing unauthorized access to files. This affects authenticated attackers with Administrator-level access or higher. The issue stems from the kds flag functionality when importing featured images, enabling the reading of arbitrary files on the server. These files may contain sensitive information.

Recommendations Update the 简数采集器 plugin to a version later than 2.6.3.

Fix

Weakness Enumeration

CWE-73

Related Identifiers

CVE-2025-11973

Affected Products

简数采集器

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2025-11973 · Security Note
• https://t.me/CVEtracker/37919 · Telegram Post
• https://plugins.trac.wordpress.org/browser/gallery-photo-gallery/trunk/includes/lists/class-gallery-photo-gallery-list-table.php#L1060 · Note
• https://twitter.com/CVEnew/status/1991791097434067382 · Twitter Post
• https://wordpress.org/plugins/keydatas · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/66dc2ca2-c61c-4c73-aa2a-0017299cbca5?source=cve · Note