Is CVE-2019-25779 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2019-25779 being exploited in the wild.

How severe is CVE-2019-25779?

High severity, with a CVSS score of 7.5, published 22 October 2026.

Which products and versions are affected?

WooThemes Diarise through 1.5.9.

Is there a fix for CVE-2019-25779?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2019-25779 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2019-25779?

Check whether you run WooThemes Diarise at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2019-25779: WooThemes Diarise arbitrary file read in download.php

CVE-2019-25779 · Severity: high · CVSS 7.5 · Published 2026-10-22

WooThemes Diarise is a WordPress theme that handles calendar-related functionality. The theme's download.php file contains a vulnerability that allows unauthenticated attackers to read arbitrary files from the server by manipulating the calendar parameter with file:// scheme paths, potentially exposing sensitive data like system configuration files.

Vendors: WooThemes.

Quick answers

Is CVE-2019-25779 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2019-25779 being exploited in the wild.
How severe is CVE-2019-25779?: High severity, with a CVSS score of 7.5, published 22 October 2026.
Which products and versions are affected?: WooThemes Diarise through 1.5.9.
Is there a fix for CVE-2019-25779?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2019-25779 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2019-25779?: Check whether you run WooThemes Diarise at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a local file inclusion (LFI) / arbitrary file read in the download.php file of the Diarise WordPress theme. An unauthenticated remote attacker can craft GET requests with file:// URI scheme paths in the calendar parameter to retrieve arbitrary files. The vulnerability requires no authentication or user interaction and allows disclosure of sensitive files such as /etc/passwd.

Affected products

WooThemes Diarise through 1.5.9

Timeline

2019-05-07: disclosed
2023-10-19: exploited: Exploitation evidence observed by Shadowserver Foundation

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.