Back to Database
Status published
High
CVE-2019-25215
ARI-Adminer <= 1.1.14 - Missing Authorization and No Direct File Access Restrictions
Vulnerability Description
The ARI-Adminer plugin for WordPress is vulnerable to authorization bypass due to a lack of file access controls in nearly every file of the plugin in versions up to, and including, 1.1.14. This makes it possible for unauthenticated attackers to call the files directly and perform a wide variety of unauthorized actions such as accessing a site's database and making changes.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2019-25215
Credits & Attribution
No credits recorded in the NVD database.
References
More from arisoft
View All →CVE-2025-58784
WordPress ARI Fancy Lightbox Plugin <= 1.4.0 - Cross Site Scripting (XSS) Vulnerability
Medium
6.5
CVE-2025-48345
WordPress Contact Form 7 Editor Button plugin <= 1.0.0 - Reflected Cross Site Scripting (XSS) vulnerability
High
7.1
CVE-2024-47310
WordPress ARI Fancy Lightbox -- Popup for WordPress plugin <= 1.3.17 - Cross Site Scripting (XSS) vulnerability
Medium
6.5
Affected Vendor
arisoft
View all reports →Affected Software
ARI Adminer – WordPress Database Manager
Vulnerable Versions:
0
Timeline
Official Publish:
October 16th, 2024
Last Modified:
April 8th, 2026
Added to House:
July 20th, 2026
CVSS Vectors
V3:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L