diarise
diarise is a WordPress theme with 1 published CVE record in this archive. The latest tracked vulnerability was published Oct 22, 2026; the highest published CVSS base score is 8.7.
diariseCVE-2019-25779: Diarise: Unauthenticated file disclosure
WooThemes Diarise through 1.5.9 contains a file read vulnerability that allows unauthenticated attackers to read arbitrary files through the calendar parameter of download.php. Attackers can send GET requests with file:// scheme paths to the calendar parameter to disclose sensitive files like /etc/passwd. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-19. Other endpoint, parameter, role or implementation details not named in this export are not established by this record. Affected versions: at most 1.5.9. These observations are historical, not evidence of current active exploitation.
| Safe version |
|
||
|---|---|---|---|
| Oct 22, 2026 |
CVE-2019-25779
Diarise: Unauthenticated file disclosure
WooThemes Diarise through 1.5.9 contains a file read vulnerability that allows unauthenticated attackers to read arbitrary files through the calendar parameter of download.php. Attackers can send GET requests with file:// scheme paths to the calendar parameter to disclose sensitive files like /etc/passwd. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-19. Other endpoint, parameter, role or implementation details not named in this export are not established by this record. Affected versions: at most 1.5.9. These observations are historical, not evidence of current active exploitation.
|
See mitigation notes |
CVE8.7
|