CVE-2019-25217: Siteground Speed Optimizer remote code execution (CVSS 9.8)

Description

The SiteGround Optimizer plugin for WordPress is vulnerable to authorization bypass leading to Remote Code Execution and Local File Inclusion in versions up to, and including, 5.0.12 due to incorrect use of an access control attribute on the switch_php function called via the /switch-php REST API route. This allows attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.

CVSS 3.1 breakdown

Attack vectorNetwork

Attack complexityLow

Privileges requiredNone

User interactionNone

ScopeUnchanged

ConfidentialityHigh

IntegrityHigh

AvailabilityHigh

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

Siteground Speed Optimizer< 5.0.12

Remediation

Fixed in

Siteground Speed Optimizer≥ 5.0.12

References

https://blog.sucuri.net/2019/03/vulnerability-disclosure-siteground-optimizer-caldera-forms.htmlPress/Media CoverageTechnical Description
https://www.wordfence.com/threat-intel/vulnerabilities/id/657f3bd7-2cdc-4eb6-ba50-7c7fca468df0?source=cveThird Party Advisory

Related CVEs

Recent high-severity vulnerabilities sharing a weakness type.

Frequently asked

Is CVE-2019-25217 being actively exploited?

CVE-2019-25217 is not in the CISA KEV catalog. Its EPSS exploit probability is 0.85%.

How severe is CVE-2019-25217?

CVE-2019-25217 has a CVSS 3.1 base score of 9.8, rated critical. EPSS estimates a 0.85% probability of exploitation.

Which products are affected by CVE-2019-25217?

Affected products include Siteground Speed Optimizer.

How do I fix CVE-2019-25217?

Upgrade affected software to a fixed version, for example Siteground Speed Optimizer 5.0.12 or later, then confirm no affected versions remain in your inventory.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2019-25217 against the real software inventory on every managed device, every day. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation works Book a demo