CVE-2019-25779 WooThemes Diarise 1.5.9 Local File Disclosure via download.php

High 8.7 Published 22 Oct 2026 Updated 22 Oct 2026

Exploited in the wild: Not known
Fix: None listed

What is CVE-2019-25779?

CVE-2019-25779 is a high-severity vulnerability in WooThemes Diarise, published on 22 Oct 2026.

Official description

WooThemes Diarise through 1.5.9 contains a file read vulnerability that allows unauthenticated attackers to read arbitrary files through the calendar parameter of download.php. Attackers can send GET requests with file:// scheme paths to the calendar parameter to disclose sensitive files like /etc/passwd. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-19.

Weakness: CWE-22

Which versions are affected by CVE-2019-25779?

How do I fix CVE-2019-25779?

No fix has been published for CVE-2019-25779 yet. Limit exposure of the affected software until one is available.

Is CVE-2019-25779 being exploited?

There is no known exploitation of CVE-2019-25779 in the wild and no public exploit code.

Sources

Also known as GHSA-57gp-6fh6-hf38.