CVE-2019-25217: SiteGround Optimizer <= 5.0.12 - Missing Authorization
The SiteGround Optimizer plugin for WordPress is vulnerable to authorization bypass leading to Remote Code Execution and Local File Inclusion in versions up to, and including, 5.0.12 due to incorrect use of an access control attribute on the switchphp function called via the /switch-php REST API route. This allows attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2019-25217?
CVE-2019-25217 is classified as a critical vulnerability due to its potential for Remote Code Execution and Local File Inclusion.
How do I fix CVE-2019-25217?
To fix CVE-2019-25217, upgrade the SiteGround Optimizer plugin to version 5.0.13 or later.
What types of attacks can CVE-2019-25217 facilitate?
CVE-2019-25217 can facilitate attacks such as unauthorized access, remote code execution, and file inclusion.
Which versions of SiteGround Optimizer are affected by CVE-2019-25217?
CVE-2019-25217 affects SiteGround Optimizer versions up to and including 5.0.12.
Who is vulnerable to CVE-2019-25217?
Any WordPress site using the SiteGround Optimizer plugin version 5.0.12 or earlier is vulnerable to CVE-2019-25217.