{"id":"CVE-2025-11973","aliases":["EUVD-2025-198383","GHSA-xg4x-w83h-xxj6"],"status":"published","title":"简数采集器 \u003c= 2.6.3 - Authenticated (Admin+) Arbitrary File Read","description":"The 简数采集器 plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 2.6.3 via the __kds_flag functionality that imports featured images. This makes it possible for authenticated attackers, with Adminstrator-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.","severity":{"version":"3.1","score":4.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00343,"percentile":0.28051,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-73"],"published":"2025-11-21T08:28:12Z","modified":"2026-10-08T10:10:00Z","exploits":[{"source":"pocgithub","id":"jFriedli/CVE-2025-11973","title":"jFriedli/CVE-2025-11973","date":"2026-03-23","url":"https://github.com/jFriedli/CVE-2025-11973"}],"products":[{"vendor":"zhengdon","product":"简数采集器"}],"references":[{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/66dc2ca2-c61c-4c73-aa2a-0017299cbca5?source=cve"},{"url":"https://wordpress.org/plugins/keydatas/"},{"url":"https://plugins.trac.wordpress.org/browser/gallery-photo-gallery/trunk/includes/lists/class-gallery-photo-gallery-list-table.php#L1060"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-11973"},{"url":"https://wordpress.org/plugins/keydatas"},{"url":"https://github.com/advisories/GHSA-xg4x-w83h-xxj6"}],"sources":{"cve":[{"id":"CVE-2025-11973","title":"简数采集器 \u003c= 2.6.3 - Authenticated (Admin+) Arbitrary File Read","description":"The 简数采集器 plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 2.6.3 via the __kds_flag functionality that imports featured images. This makes it possible for authenticated attackers, with Adminstrator-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.","status":"published","published":"2025-11-21T08:28:12.074Z","modified":"2026-04-08T16:58:05.517Z","cvss":[{"version":"3.1","score":4.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-73"],"updated_at":"2026-11-02T14:32:50.520421Z"}],"euvd":[{"id":"EUVD-2025-198383","description":"The 简数采集器 plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 2.6.3 via the __kds_flag functionality that imports featured images. This makes it possible for authenticated attackers, with Adminstrator-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.","status":"published","published":"2025-11-21T08:28:12Z","modified":"2026-04-08T16:58:05Z","cvss":[{"version":"3.1","score":4.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T19:24:55.662835Z"}],"ghsa":[{"id":"GHSA-xg4x-w83h-xxj6","title":"The 简数采集器 plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and...","description":"The 简数采集器 plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 2.6.3 via the __kds_flag functionality that imports featured images. This makes it possible for authenticated attackers, with Adminstrator-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.","status":"published","published":"2025-11-21T09:30:28Z","modified":"2026-04-08T18:33:59Z","cvss":[{"version":"3.1","score":4.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-73"],"updated_at":"2026-11-02T15:07:16.301048Z"}],"nvd":[{"id":"CVE-2025-11973","description":"The 简数采集器 plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 2.6.3 via the __kds_flag functionality that imports featured images. This makes it possible for authenticated attackers, with Adminstrator-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.","status":"published","published":"2025-11-21T09:15:46.193Z","modified":"2026-10-08T10:10:00.227Z","cvss":[{"version":"3.1","score":4.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-73"],"updated_at":"2026-11-02T14:11:46.009629Z"}]}}