WordPress Plugin Vulnerabilities

Propovoice < 1.7.7 - Unauthenticated Arbitrary File Read

Description

The Propovoice: All-in-One Client Management System plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 1.7.6.7 via the send_email() function. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information.

Affects Plugins

Plugin icon
propovoice
Fixed in 1.7.7

References

CVE
CVE-2025-8422
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/3ac72d7a-9540-435f-93cb-fdd4104b18f7

Classification

Type
FILE DELETION
OWASP top 10
A6: Security Misconfiguration
CWE
CWE-73
CVSS
7.5 (high)

Miscellaneous

Original Researcher
mikemyers
Verified
No
WPVDB ID
69b462b6-79f3-413f-8fb7-4d869a4a0c43

Timeline

Publicly Published
2025-09-10 (about 1 year ago)
Added
2025-09-10 (about 1 year ago)
Last Updated
2025-10-21 (about 10 months ago)

Other

Published
Title
Published
2025-05-29
Title
Apptha Slider Gallery <= 2.5 - Unauthenticated Arbitrary File Read
Published
2025-07-30
Title
NinjaScanner < 3.2.6 - Admin+ Arbitrary File Deletion
Published
2022-08-08
Title
Export All URLs < 4.4 - Admin+ Arbitrary System File Removal
Published
2025-12-11
Title
WP User Manager < 2.9.13 - Authenticated (Subscriber+) Arbitrary File Deletion via 'current_user_avatar' Parameter
Published
2026-06-27
Title
Frontend File Manager Plugin <= 23.6 - Authenticated (Subscriber+) Arbitrary File Deletion