CVE-2025-9519

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-9519", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-08-26T23:53:17.887Z", "datePublished": "2025-09-04T04:23:48.956Z", "dateUpdated": "2026-04-08T17:11:55.000Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:11:55.000Z"}, "affected": [{"vendor": "kleor", "product": "Easy Timer", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "4.2.1", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Easy Timer plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.2.1 via the plugin's shortcodes. This is due to insufficient restriction of shortcode attributes. This makes it possible for authenticated attackers, with Editor-level access and above, to execute code on the server."}], "title": "Easy Timer <= 4.2.1 - Authenticated (Editor+) Remote Code Execution via Shortcode", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/9f2d8a68-4cb9-44bc-b4ae-43a8e8468634?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/easy-timer/trunk/shortcodes.php"}, {"url": "https://plugins.trac.wordpress.org/changeset/3355111/"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-94 Improper Control of Generation of Code ('Code Injection')", "cweId": "CWE-94", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.2, "baseSeverity": "HIGH"}}], "credits": [{"lang": "en", "type": "finder", "value": "Jonas Benjamin Friedli"}], "timeline": [{"time": "2025-08-27T17:24:13.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2025-09-03T00:00:00.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-09-04T13:59:29.842813Z", "id": "CVE-2025-9519", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-09-04T13:59:43.517Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-9519", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-09-04T13:59:29.842813Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-09-04T13:59:36.709Z"}}], "cna": {"title": "Easy Timer <= 4.2.1 - Authenticated (Editor+) Remote Code Execution via Shortcode", "credits": [{"lang": "en", "type": "finder", "value": "Jonas Benjamin Friedli"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.2, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"}}], "affected": [{"vendor": "kleor", "product": "Easy Timer", "versions": [{"status": "affected", "version": "*", "versionType": "semver", "lessThanOrEqual": "4.2.1"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-08-27T17:24:13.000+00:00", "value": "Vendor Notified"}, {"lang": "en", "time": "2025-09-03T00:00:00.000+00:00", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/9f2d8a68-4cb9-44bc-b4ae-43a8e8468634?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/easy-timer/trunk/shortcodes.php"}, {"url": "https://plugins.trac.wordpress.org/changeset/3355111/"}], "descriptions": [{"lang": "en", "value": "The Easy Timer plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.2.1 via the plugin's shortcodes. This is due to insufficient restriction of shortcode attributes. This makes it possible for authenticated attackers, with Editor-level access and above, to execute code on the server."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-94", "description": "CWE-94 Improper Control of Generation of Code ('Code Injection')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2025-09-04T04:23:48.956Z"}}}, "cveMetadata": {"cveId": "CVE-2025-9519", "state": "PUBLISHED", "dateUpdated": "2025-09-04T13:59:43.517Z", "dateReserved": "2025-08-26T23:53:17.887Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-09-04T04:23:48.956Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Easy Timer", "vendor": "kleor", "versions": [{"lessThanOrEqual": "4.2.1", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Easy Timer plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.2.1 via the plugin's shortcodes. This is due to insufficient restriction of shortcode attributes. This makes it possible for authenticated attackers, with Editor-level access and above, to execute code on the server."}], "id": "CVE-2025-9519", "lastModified": "2026-06-17T10:09:09.490", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.2, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 5.9, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-9519", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2025-09-04T13:59:29.842813Z", "version": "2.0.3"}}]}, "published": "2025-09-04T10:42:35.590", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/easy-timer/trunk/shortcodes.php"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset/3355111/"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/9f2d8a68-4cb9-44bc-b4ae-43a8e8468634?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-94"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-21T03:17:13.074646+00:00", "value": {"mitigation_remediation": ["Upgrade the Easy Timer plugin to the latest version (4.2.2 or newer) to remove the vulnerable shortcode handling.", "If an update is not feasible, disable the Easy Timer plugin or the shortcode functionality until a patch is available.", "Restrict Editor+ role privileges or remove unnecessary Editor+ accounts to reduce the number of users who could exploit the flaw."], "summary": {"action": "Immediate Patch", "impact": "Remote Code Execution"}, "threat_synthesis": {"affected_systems": "The vulnerability affects the Easy Timer plugin developed by Kleor, in all versions up to and including 4.2.1. WordPress sites that have this plugin installed and have users with Editor or higher roles are at risk.", "description_and_impact": "The Easy Timer WordPress plugin contains a flaw that allows an authenticated user with Editor or higher privileges to execute arbitrary PHP code on the web server. The flaw originates from insufficient restriction of attributes passed to shortcodes, enabling the attacker to inject code that runs with the permissions of the web server. This weakness is classified as CWE\u201194, indicating a code injection vulnerability.", "risk_and_exploitability": "The CVSS score of 7.2 indicates a high severity, while the EPSS score of <1% suggests the likelihood of exploitation is low as of now. The vulnerability is not listed in CISA KEV, meaning it has not yet been observed in the wild. Attackers must be authenticated, possess Editor+ access, and craft a malicious shortcode to trigger the flaw. Once triggered, they can run arbitrary PHP code, potentially compromising the entire WordPress installation and the underlying server."}}}}, "created": "2025-09-04T13:12:13.683673+00:00", "updated": "2026-04-21T03:30:26.329179+00:00", "vendors": ["wordpress", "wordpress$PRODUCT$wordpress"]}