Vulnerability · Published Sep 4, 2025 · Assigned by Wordfence
CVE-2025-9519Easy Timer <= 4.2.1 - Authenticated (Editor+) Remote Code Execution via Shortcode
High 7.2
In plain English
A high-severity code injection in Easy Timer from kleor. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 60% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.
Official description
The Easy Timer plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.2.1 via the plugin's shortcodes. This is due to insufficient restriction of shortcode attributes. This makes it possible for authenticated attackers, with Editor-level access and above, to execute code on the server.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| kleor | Easy Timer | 0 – through 4.2.1 |
Weakness: CWE-94 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H