# CVE-2019-25213: Advanced Access Manager – Restricted Content, Users & Roles, Enhanced Security and More - Path Traversal

> Live exploitation tracking for CVE-2019-25213 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2019-25213

## Key facts

- **Exploitation phase:** Limited Exploitation. The vulnerability is known but shows very limited attacker interest or exploitation activity.
- **CVSS score:** 9.8
- **Public exploit available:** Yes
- **Affected products:** Vasyltech Advanced Access Manager – Restricted Content, Users & Roles, Enhanced Security and More
- **Weaknesses:** CWE-22 (Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'))
- **Tags:** cms, wordpress

## Description

The Advanced Access Manager plugin for WordPress is vulnerable to Unauthenticated Arbitrary File Read in versions up to, and including, 5.9.8.1 due to insufficient validation on the aam-media parameter. This allows unauthenticated attackers to read any file on the server, including sensitive files such as wp-config.php

## CrowdSec analysis

[CVE-2019-25213](https://euvd.enisa.europa.eu/vulnerability/CVE-2019-25213) is a critical vulnerability in the Advanced Access Manager plugin for WordPress that allows unauthenticated attackers to read arbitrary files on the server, including highly sensitive files like wp-config.php. Exploiting this flaw could lead to the exposure of database credentials and other confidential information, potentially enabling further attacks such as site takeover or data theft.

CrowdSec has been tracking this vulnerability and its exploits since 10th of December 2025.

CrowdSec has not observed any significant exploitation activity targeting CVE-2019-25213 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.

Attackers exploit the `/wp-admin/admin-ajax.php` endpoint with the `action=aam-media-load` and `aam-media` parameters to perform path traversal and read sensitive files such as `wp-config.php`.

## Timeline

- 2024-10-16: CVE Published. CVE-2019-25213 is published to NVD.
- 2025-12-10: Rule Released. CrowdSec releases a rule to detect CVE-2019-25213 exploitation attempts against the CrowdSec Network.

## References

- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-25213.yaml

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2019-25213) follows observed exploitation activity for CVE-2019-25213. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.