CVE-2019-25217 describes a critical authorization bypass vulnerability in the SiteGround Optimizer WordPress plugin, affecting versions up to and including 5.0.12. This flaw allows unauthenticated attackers to achieve Remote Code Execution and Local File Inclusion by exploiting improper access controls on the switch_php function. With a CVSS score of 9.8 (Critical), the vulnerability is easily exploitable over the network with low complexity, enabling attackers to execute arbitrary PHP code, bypass security measures, and access sensitive data. While the EPSS score is relatively low, indicating a lower probability of exploitation in the wild compared to many CVEs, there is no public exploit code available (Metasploit, Nuclei, ExploitDB), and it is not listed in the KEV catalog. Community discussion and media coverage are also minimal.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 5.0.12CPE matchmatch criteria | cpe:2.3:a:siteground:speed_optimizer:*:*:*:*:*:wordpress:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.