What is the CVSS score of CVE-2019-15867?

CVE-2019-15867 has a CVSS 3.0 base score of 8.8 (High). CVSS vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 2.1%.

Is there a public PoC exploit available for CVE-2019-15867?

Yes, a public proof-of-concept exploit is available for CVE-2019-15867. Prioritise patching immediately. EPSS: 2.1%.

Wordpress Plugin CVE-2019-15867

HIGH

Use of Hard-coded Credentials (CWE-798)

2019-09-03 cve@mitre.org

WordPress Authentication Bypass Wordpress Plugin Slick Popup

8.8

CVSS 3.0 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

CVE Published

Sep 03, 2019 - 12:15 nvd

HIGH 8.8

DescriptionNVD

The slick-popup plugin before 1.7.2 for WordPress has a hardcoded OmakPass13

password for the slickpopupteam account, after a Subscriber calls a certain AJAX action.

AnalysisAI

The slick-popup plugin before 1.7.2 for WordPress has a hardcoded OmakPass13

password for the slickpopupteam account, after a Subscriber calls a certain AJAX action. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

Technical ContextAI

This vulnerability is classified as Use of Hard-coded Credentials (CWE-798), which allows attackers to gain access using credentials embedded in source code. The slick-popup plugin before 1.7.2 for WordPress has a hardcoded OmakPass13

password for the slickpopupteam account, after a Subscriber calls a certain AJAX action. Affected products include: Omaksolutions Slick-Popup. Version information: before 1.7.2.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Remove hard-coded credentials, use environment variables or secrets management, rotate exposed credentials immediately.

More in Wordpress Plugin

View all

CVE-2023-6553 CRITICAL Act Now POC

9.8 Dec 15

The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1

CVE-2024-5084 CRITICAL Act Now POC

9.8 May 23

The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil

CVE-2024-44000 CRITICAL Emergency POC

9.8 Oct 20

Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote

CVE-2020-36847 CRITICAL Act Now POC

9.8 Jul 12

The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner

CVE-2025-27007 CRITICAL Emergency POC

9.8 May 01

The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut

CVE-2016-1209 CRITICAL Emergency POC

9.8 May 14

The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via

CVE-2024-4443 CRITICAL Act Now POC

9.8 May 22

The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based

CVE-2024-1698 CRITICAL Act Now POC

9.8 Feb 27

SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a

CVE-2023-6875 CRITICAL Emergency POC

9.8 Jan 11

The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i

CVE-2024-1512 CRITICAL Emergency POC

9.8 Feb 17

The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base

CVE-2024-4295 CRITICAL Act Now POC

9.8 Jun 05

The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘hash’ parameter in

CVE-2024-50498 CRITICAL Emergency POC

10.0 Oct 28

Remote code execution in the WP Query Console WordPress plugin (versions up to and including 1.0) by Ajit Bohra allows u

Same weakness CWE-798 – Use of Hard-coded Credentials

View all

CVE-2016-1560 CRITICAL POC

9.8

CVE-2017-14143 CRITICAL POC

9.8

CVE-2026-22769 CRITICAL

10.0

CVE-2016-5678 CRITICAL POC

9.8

CVE-2017-6558 CRITICAL POC

9.8

CVE-2015-7246 CRITICAL POC

9.8

CVE-2015-4667 CRITICAL POC

9.8

CVE-2016-10177 CRITICAL POC

9.8

Same technique Authentication Bypass

View all

CVE-2023-22515 CRITICAL POC

9.8

CVE-2012-4681 CRITICAL POC

9.8

CVE-2013-2465 CRITICAL POC

9.8

CVE-2011-3544 CRITICAL POC

9.8

CVE-2022-40684 CRITICAL POC

9.8

CVE-2025-61882 CRITICAL POC

9.8

CVE-2024-0012 CRITICAL POC

9.3

CVE-2023-46805 HIGH POC

8.2

CVE-2019-15867 vulnerability details – vuln.today

Back

Wordpress Plugin CVE-2019-15867

Severity by source

CVSS VectorNVD

Lifecycle Timeline

DescriptionNVD

password for the slickpopupteam account, after a Subscriber calls a certain AJAX action.

AnalysisAI

password for the slickpopupteam account, after a Subscriber calls a certain AJAX action. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

Technical ContextAI

password for the slickpopupteam account, after a Subscriber calls a certain AJAX action. Affected products include: Omaksolutions Slick-Popup. Version information: before 1.7.2.

RemediationAI

More in Wordpress Plugin

Same weakness CWE-798 – Use of Hard-coded Credentials

Same technique Authentication Bypass

Share

External POC / Exploit Code