critical·Product Based Web Vulnerabilities·Updated Dec 1, 2025

WordPress Advanced Access Manager - Path Traversal

Run This Scanner →

Est. Time~10 seconds

Scan TypeGroup Scan

Targetsurl

CostFree

2.4k

Times Used

continuous scan runs

Continuously Checked

assets under CS

Vulnerabilities Found

confirmed findings

References

github.com↗

CVECVE-2019-25213

9.8

CVSScritical

Exploitable remotely over the internet · no authentication required.

The Advanced Access Manager plugin for WordPress is vulnerable to Unauthenticated Arbitrary File Read in versions up to, and including, 5.9.8.1 due to insufficient validation on the aam-media parameter. This allows unauthenticated attackers to read any file on the server, including sensitive files such as wp-config.php

Attack Vector

Network

Privileges Req.

None

User Interaction

None

Affected

Advanced Access Manager – Access Governance for WordPressby vasyltech

AFFECTED< 5.9.9→SAFE ✓≥ 5.9.9

advanced_access_managerby advanced_access_manager_project

AFFECTED< 5.9.9→SAFE ✓≥ 5.9.9

Updated Sep 9, 2026View on NVD →

Similar Tools

Check your infrastructure.
Right now.

11,000+ scanners. Free to start. No credit card required.

Run This Scanner →Browse All Tools

WordPress Advanced Access Manager - Path Traversal

Check your infrastructure.Right now.

Check your infrastructure.
Right now.