Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.5

Accio WordPress template can leak user login data

CVE-2015-9485 · published 7 years ago
Summary

The Accio Responsive Parallax One Page Site Template for WordPress lets anyone request a specific file and retrieve usernames, passwords and email addresses stored in the site. This exposure can let attackers impersonate users or gain unauthorized access. Update the template to the latest version or remove the vulnerable file to stop the data leak.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
accio_responsive_onepage_parallax_site_template_project accio_responsive_onepage_parallax_site_template <= 2015-05-15
cpe:2.3:a:accio_responsive_onepage_parallax_site_template_project:accio_responsive_onepage_parallax_site_template:*:*:*:*:*:wordpress:*:*
Original advisory text
The ThemeMakers Accio Responsive Parallax One Page Site Template component through 2015-05-15 for WordPress allows remote attackers to obtain sensitive information (such as user_login, user_pass, a...
The ThemeMakers Accio Responsive Parallax One Page Site Template component through 2015-05-15 for WordPress allows remote attackers to obtain sensitive information (such as user_login, user_pass, and user_email values) via a direct request for the wp-content/uploads/tmm_db_migrate/wp_users.dat URI.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker partial control (estimated)
Severity
7.5 High
Exploitation
3% chance of attack within 30 days
Type
CWE-200Information Exposure
Timeline
Published11 Oct 2019
Updated31 Oct 2026
First seen29 Sep 2026
Sources
CVE-2015-9485 · NVD
Track software like this
Free during beta