CVE-2025-9519

HIGH

Easy Timer <= 4.2.1 - Authenticated (Editor+) Remote Code Execution via Shortcode

Title source: CVE List
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2025-9519 has a selected CVSS score of 7.2 (high); EIP currently links 1 repository PoC and 1 lab environment.

Description

The Easy Timer plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.2.1 via the plugin's shortcodes. This is due to insufficient restriction of shortcode attributes. This makes it possible for authenticated attackers, with Editor-level access and above, to execute code on the server.

Description source: CVE List

Exploitation context

Available material

Repository PoCs
1
Lab environments
1

CISA SSVC decision

ExploitationNone
AutomatableNo
Technical impactTotal

CISA Coordinator · SSVC 2.0.3 · Evaluated Sep 4, 2025 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

Easy Timer

Browse kleor / Easy Timer

Default status: unaffected

CVE ListThrough 4.2.1affected

Proofs of concept

1

Repository PoCs

GitHubNimisha17/CVE-2024-9348-pocRepository PoCby Nimisha170Exploit8 files

4.8 KiB · linked to 3 vulnerabilities

GitHub
PoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The README.md provides step-by-step instructions to achieve Remote Code Execution (RCE) on a WordPress instance running the Easy Timer plugin (CVE-2025-9519) by injecting a shell_exec call via a shortcode attribute.

Backdoor review

No backdoor observed in reviewed code

The supplied README.md provides step-by-step instructions for setting up a WordPress environment and demonstrating a Remote Code Execution (RCE) vulnerability in the Easy Timer plugin via a shortcode. The instructions are consistent with the claimed CVE-2025-9519 and do not contain any concealed, deceptive, or operator-directed harmful behavior beyond the documented exploit demonstration.

ClassificationExploit
Model confidence95%
AuthenticationRequired
Languagesmarkdown
Target softwareWordPressEasy Timer plugin
Attack typesremote code executioncode injection
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact provides explicit instructions for executing arbitrary commands on a target system via a crafted shortcode, which constitutes exploit code in the form of a documented procedure.

README.md:48-50

Requirements

  • Docker Engine and Docker Compose installedREADME.md:5-6
  • WordPress instance with Easy Timer plugin v4.2.1 activatedREADME.md:19-29
  • Authenticated user with Editor-level privilegesREADME.md:36-39

Observed behavior

  • Instructs user to create a post with a shortcode block containing a malicious filter attribute that calls shell_exec to execute an arbitrary system command (ls -l)README.md:48-50
  • Claims successful RCE upon previewing the postREADME.md:59
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Exploit Instruction
Payload withheldDemonstrates the claimed RCE vulnerability in the Easy Timer plugin by executing the 'ls -l' command on the server.README.md:49
Review boundaries

What the analysis did not establish

  • Only the README.md file content is provided; 7 other files in the repository are omitted.
  • The analysis is based solely on the supplied text; the exploit was not executed or verified.
  • The artifact references multiple CVEs (CVE-2024-9348, CVE-2025-48385, CVE-2025-9519) but the README content only describes exploitation of CVE-2025-9519.
  • Only the README.md file was provided for review; 7 other text files in the repository were omitted from the evidence packet.
  • No source code, scripts, or binary files were included for analysis.
  • The review is limited to the supplied text content and does not verify the actual behavior of the described exploit.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Docker lab environments

1
GitHub

docker-compose.yml

Nimisha17/CVE-2024-9348-pocCreated Vuln labCVE-2025-9519Compose · images

1 Compose manifest · 3 services

View exploit
Analysisdeepseek-v4-pro:cloud ·

Environment assessment

A Docker Compose environment running WordPress with MySQL, designed to demonstrate an RCE vulnerability in the Easy Timer plugin.

docker-compose.yml:1-47README.md:1-85

Lab assessment

Vulnerability lab

The README explicitly describes steps to exploit a remote code execution vulnerability in the Easy Timer plugin, including a shortcode payload that executes a shell command.

README.md:1-85
Lab shapeCompose · images
Services3
Compose manifests1
Dockerfiles0
Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries
Components

Services and files described by the evidence

db

database

MySQL 5.7 database service for WordPress, with persistent storage.

docker-compose.yml:2-11

wordpress

web servervulnerable target

WordPress 7.4 with Apache, serving on host port 8000. A bind mount of ./wp-content allows plugin installation. The Easy Timer plugin is installed and activated to demonstrate RCE.

docker-compose.yml:13-25README.md:13-22

wpcli

command-line tool

WordPress CLI container used to create an editor user for the exploit scenario.

docker-compose.yml:27-40README.md:30-36
CVE assessment

How the supplied evidence relates each vulnerability

CVE-2025-9519

Supported by supplied evidence

The README describes an RCE via the Easy Timer plugin's countdown shortcode with a 'filter' parameter set to 'shell_exec', which matches the CVE-2025-9519 identifier in the repository name.

README.md:1-85
Exercise context

Requirements and sequence described by the evidence

Prerequisites

  • Docker Engine and Docker Compose installed.README.md:5-6
  • Easy Timer plugin version 4.2.1 downloaded and installed.README.md:13-22
  • An editor-level user created via WP-CLI.README.md:30-36

Evidence-described exercise path

  1. Start the Docker Compose environment.README.md:11-12
  2. Download and install the Easy Timer plugin.README.md:13-22
  3. Complete WordPress setup and activate the Easy Timer plugin.README.md:24-28
  4. Create an editor user with WP-CLI.README.md:30-36
  5. Create a post with a malicious shortcode that executes a shell command.README.md:40-48
Safety-review evidence

Behaviors behind the stored safety assessment

No harmful behavior observed

The environment is a self-contained vulnerability lab. The exploit targets the WordPress container only, and there is no evidence of host escape, persistence, credential theft, or external communication beyond the documented lab setup.

docker-compose.yml:1-47README.md:1-85
Review boundaries

What the analysis did not establish

  • The packet does not include the Easy Timer plugin source code, so the exact vulnerable code path cannot be verified.
  • The repository has multiple aliases (CVE-2024-9348, CVE-2025-48385, CVE-2025-9519), but only CVE-2025-9519 is explicitly associated with the unit; the relationship to the other CVEs is unclear.
Model interpretation

This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.

References

4