{"id":"CVE-2019-25779","title":"WooThemes Diarise 1.5.9 Local File Disclosure via download.php","summary":"WooThemes Diarise through 1.5.9 contains a file read vulnerability that allows unauthenticated attackers to read arbitrary files through the calendar parameter of download.php. Attackers can send GET requests with file:// scheme paths to…","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cvssSource":"cna","cwe":["CWE-22"],"vendor":"WooThemes","product":"Diarise","affected":["Diarise <= 1.5.9"],"published":"2026-10-22","updated":"2026-10-22","sourceUpdated":"2026-10-22T10:57:27.435Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2019-25779","references":[{"url":"https://packetstorm.news/files/id/152773/","label":"Packet Storm 152773"},{"url":"https://cxsecurity.com/issue/WLB-2019050123","label":"CXSecurity WLB-2019050123"},{"url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/vulnerabilities/wordpress/diarise-theme-lfi.yaml","label":"Nuclei Template"},{"url":"https://www.vulncheck.com/advisories/woothemes-diarise-1.5.9-local-file-disclosure-via-download-php","label":"VulnCheck Advisory: WooThemes Diarise 1.5.9 Local File Disclosure via download.php"}],"tags":["cve.org"],"ingestedAt":"2026-10-22T11:37:02.344Z","slug":"CVE-2019-25779","body":"## Overview\n\nWooThemes Diarise through 1.5.9 contains a file read vulnerability that allows unauthenticated attackers to read arbitrary files through the calendar parameter of download.php. Attackers can send GET requests with file:// scheme paths to the calendar parameter to disclose sensitive files like /etc/passwd. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-19.\n\n## Affected\n\n- `Diarise <= 1.5.9`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}