{"id":"CVE-2025-1565","aliases":["EUVD-2025-12544","GHSA-9hgh-ww8v-4jw6"],"status":"published","title":"Mayosis Core \u003c= 5.4.1 - Unauthenticated Arbitrary File Read","description":"The Mayosis Core plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 5.4.1 via the library/wave-audio/peaks/remote_dl.php file. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00562,"percentile":0.47001,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-22"],"published":"2025-04-25T09:21:41Z","modified":"2026-06-17T08:39:22Z","products":[{"vendor":"teconcetheme","product":"mayosis core"}],"references":[{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b967eb98-69f8-41c5-a19a-9d20979accb0?source=cve"},{"url":"https://themeforest.net/item/mayosis-digital-marketplace-theme/20210200"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-1565"},{"url":"https://github.com/advisories/GHSA-9hgh-ww8v-4jw6"}],"sources":{"cve":[{"id":"CVE-2025-1565","title":"Mayosis Core \u003c= 5.4.1 - Unauthenticated Arbitrary File Read","description":"The Mayosis Core plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 5.4.1 via the library/wave-audio/peaks/remote_dl.php file. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information.","status":"published","published":"2025-04-25T09:21:41.127Z","modified":"2026-04-08T17:18:00.6Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"cna"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:32:49.503917Z"}],"euvd":[{"id":"EUVD-2025-12544","description":"The Mayosis Core plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 5.4.1 via the library/wave-audio/peaks/remote_dl.php file. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information.","status":"published","published":"2025-04-25T09:21:41Z","modified":"2026-04-08T17:18:00Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T19:24:43.291865Z"}],"ghsa":[{"id":"GHSA-9hgh-ww8v-4jw6","title":"The Mayosis Core plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to,...","description":"The Mayosis Core plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 5.4.1 via the library/wave-audio/peaks/remote_dl.php file. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information.","status":"published","published":"2025-04-25T12:30:27Z","modified":"2025-04-25T12:30:37Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T15:02:02.261137Z"}],"nvd":[{"id":"CVE-2025-1565","description":"The Mayosis Core plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 5.4.1 via the library/wave-audio/peaks/remote_dl.php file. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information.","status":"published","published":"2025-04-25T10:15:15.557Z","modified":"2026-06-17T08:39:22.627Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"secondary"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:11:02.570368Z"}]}}