CVE-2019-19983 Information disclosure in n/a
An attacker can discover the full web root path of the WordPress application if debug mode is enabled, potentially aiding further attacks.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2019-19983?
CVE-2019-19983 is a medium-severity vulnerability in n/a, published on 26 Dec 2019. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
In the WordPress plugin, Fast Velocity Minify before 2.7.7, the full web root path to the running WordPress application can be discovered. In order to exploit this vulnerability, FVM Debug Mode needs to be enabled and an admin-ajax request needs to call the fastvelocity_min_files action.
Weakness: CWE-200
Which versions are affected by CVE-2019-19983?
It affects 1 product.
Products include Fastvelocity Minify.
How do I fix CVE-2019-19983?
No fix has been published for CVE-2019-19983 yet. Limit exposure of the affected software until one is available.
Is CVE-2019-19983 being exploited?
There is no known exploitation of CVE-2019-19983 in the wild and no public exploit code.
Sources
Also known as GHSA-vmxx-j32m-f59g.