Advanced Access Manager – Restricted Content, Users & Roles, Enhanced Security and More - Path Traversal (CVE-2019-25213)

CVE-2019-25213 is a critical vulnerability in the Advanced Access Manager plugin for WordPress that allows unauthenticated attackers to read arbitrary files on the server, including highly sensitive files like wp-config.php. Exploiting this flaw could lead to the exposure of database credentials and other confidential information, potentially enabling further attacks such as site takeover or data theft.

CrowdSec has been tracking this vulnerability and its exploits since 10th of December 2025.

CrowdSec has not observed any significant exploitation activity targeting CVE-2019-25213 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.

Attackers exploit the /wp-admin/admin-ajax.php endpoint with the action=aam-media-load and aam-media parameters to perform path traversal and read sensitive files such as wp-config.php.