« Volver al listado

CVE-2025-8009

Estado: AplazadaMedia (4.9)—

The Security Ninja – WordPress Security Plugin & Firewall plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 5.242 via the 'get_file_source' function. This makes it possible for authenticated attackers, with Administrator-level access and above, to extract sensitive data, including the contents of any file on the server.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

THE Security Ninja — THE Security NinjaAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-8009",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-8009",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-07-24T13:16:48.653253Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security@wordfence.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 4.9,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "HIGH",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 1.2
      }
    ]
  },
  "affected": [
    {
      "source": "security@wordfence.com",
      "affectedData": [
        {
          "vendor": "cleverplugins",
          "product": "Security Ninja – WordPress Security Plugin & Firewall",
          "versions": [
            {
              "status": "affected",
              "version": "5.201",
              "versionType": "semver",
              "lessThanOrEqual": "5.242"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2025-07-24T08:15:30.880",
  "references": [
    {
      "url": "https://plugins.trac.wordpress.org/browser/security-ninja/trunk/modules/core-scanner/core-scanner.php#L186",
      "source": "security@wordfence.com"
    },
    {
      "url": "https://plugins.trac.wordpress.org/browser/security-ninja/trunk/modules/core-scanner/core-scanner.php#L33",
      "source": "security@wordfence.com"
    },
    {
      "url": "https://plugins.trac.wordpress.org/changeset/3333048/",
      "source": "security@wordfence.com"
    },
    {
      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/51ee45f8-9978-48ec-8f87-229dc82938a8?source=cve",
      "source": "security@wordfence.com"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security@wordfence.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-36"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The Security Ninja – WordPress Security Plugin & Firewall plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 5.242 via the 'get_file_source' function. This makes it possible for authenticated attackers, with Administrator-level access and above, to extract sensitive data, including the contents of any file on the server."
    },
    {
      "lang": "es",
      "value": "El complemento Security Ninja – WordPress Security Plugin & Firewall para WordPress es vulnerable a la lectura arbitraria de archivos en todas las versiones hasta la 5.242 incluida, mediante la función 'get_file_source'. Esto permite a atacantes autenticados, con acceso de administrador o superior, extraer datos confidenciales, incluyendo el contenido de cualquier archivo del servidor."
    }
  ],
  "lastModified": "2026-06-17T10:06:08.173",
  "sourceIdentifier": "security@wordfence.com"
}