WooThemes Diarise: Unauthenticated local file disclosure via download.php
Summary
WooThemes Diarise, a WordPress theme, contains a file read vulnerability in the calendar parameter of download.php. An unauthenticated remote attacker can send crafted GET requests with file:// paths to read arbitrary files on the server, such as /etc/passwd. Exploitation requires no login, and the vendor has not released a fix.
Affected
- WooThemes Diarise through version 1.5.9
- Some sources list 1.5.0 to 1.5.9 only
Fixed in
Unknown. No fixed version or vendor advisory found.
Workaround
- No vendor-issued workaround found.
- Block external access to the theme's download.php at the web server or WAF as an interim measure.
Exploitation
- Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-19.
- Public proof-of-concept listings and a Nuclei detection template exist.
- Sources conflict on KEV status: Exploit-Intel lists VulnCheck KEV as Listed, while HOL states current sources do not mark it as known exploited. The CISA KEV catalogue could not be verified.
- VulDB states no exploit is available, which conflicts with the public listings.
Our recommendation
- Search all WordPress sites for the Diarise theme, including child themes and nulled copies.
- Replace the unsupported theme with a maintained one.
- Until replaced, block external access to download.php and review web logs for requests with file:// or unusual calendar parameters.
- If exposure is confirmed, check for read sensitive files such as wp-config.php and rotate credentials.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- VulnCheck advisory www.vulncheck.com
- Nuclei template diarise-theme-lfi.yaml github.com
- Packet Storm 152773 packetstorm.news
- CXSecurity WLB-2019050123 cxsecurity.com
- Exploit-Intel CVE-2019-25779 exploit-intel.com
- VulDB 425255 vuldb.com
- HOL CVE-2019-25779 hol.org
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 00:53.
Original description (NVD)
WooThemes Diarise through 1.5.9 contains a file read vulnerability that allows unauthenticated attackers to read arbitrary files through the calendar parameter of download.php. Attackers can send GET requests with file:// scheme paths to the calendar parameter to disclose sensitive files like /etc/passwd. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-19.
NVD references (4)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.