PT-2026-46197 · Ad Manager Wd · Ad Manager Wd

41!Kh4224Rdz · Published 2026-06-04 · Updated 2026-06-04 · CVE-2019-25727

Mitre

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

WordPress Plugin ad manager wd 1.0.11 contains an arbitrary file download vulnerability that allows unauthenticated attackers to download sensitive files by manipulating the path parameter. Attackers can send GET requests to the edit.php endpoint with export=export csv and a malicious path parameter to read arbitrary files like wp-config.php accessible to the web server.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2019-25727

Affected Products

Ad Manager Wd

References · 4

• 🔥 https://exploit-db.com/exploits/46252 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-25727 · Security Note
• https://web-dorado.com/products/wordpress-ad-manager-wd.html · Note
• https://vulncheck.com/advisories/wordpress-plugin-ad-manager-wd-arbitrary-file-download · Note