Cpe:2.3:a:woothemes:diarise:*:*:*:*:*:*:*:* - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3awoothemesdiarise/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioThu, 22 Oct 2026 14:15:00 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgWooThemes Diarise: Arbitrary file read vulnerability (CVE-2019-25779)https://feed.craftedsignal.io/briefs/2026-10-woothemes-diarise-file-read/Thu, 22 Oct 2026 14:15:00 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-woothemes-diarise-file-read/WooThemes Diarise versions through 1.5.9 are vulnerable to an arbitrary file read exploit in download.php, allowing unauthenticated attackers to retrieve sensitive system files via a crafted calendar parameter.WooThemes Diarise through version 1.5.9 contains an arbitrary file read vulnerability. An unauthenticated attacker can exploit this via the calendar parameter in download.php by passing a file:// scheme path. This allows for the disclosure of sensitive files such as /etc/passwd. Active exploitation of this vulnerability was documented by the Shadowserver Foundation starting on 2023-10-19.

Impact

Successful exploitation allows unauthenticated remote attackers to read arbitrary files from the underlying server filesystem, potentially leading to the disclosure of configuration files, credentials, or system information.

Recommendation

  • Update WooThemes Diarise to the latest version if available, or remove the plugin if it is not business-critical.
  • Monitor web server access logs for requests to download.php where the calendar parameter contains a file scheme URI.
  • Restrict access to web application files and sanitize all user-supplied input used in file operations.
]]>highadvisoryweb-applicationfile-readlfi