Is CVE-2019-19589 actively exploited?

No active exploitation of CVE-2019-19589 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2019-19589 be exploited remotely?

Yes. CVE-2019-19589 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2019-19589?

CVE-2019-19589 has a CVSS score of 9.8 (CRITICAL).

HOME VULNERABILITIESCVE-2019-19589

CRITICAL

CVE-2019-19589

CWE-436Published: December 5, 2019· Updated: Jun 17, 2026

9.8

CVSS v3.1

Official Description

The Lever PDF Embedder plugin 4.4 for WordPress does not block the distribution of polyglot PDF documents that are valid JAR archives. Note: It has been argued that "The vulnerability reported in PDF Embedder Plugin is not valid as the plugin itself doesn't control or manage the file upload process. It only serves the uploaded PDF files and the responsibility of uploading PDF file remains with the Site owner of Wordpress installation, the upload of PDF file is managed by Wordpress core and not by PDF Embedder Plugin. Control & block of polyglot file is required to be taken care at the time of upload, not on showing the file. Moreover, the reference mentions retrieving the files from the browser cache and manually renaming it to jar for executing the file. That refers to a two step non-connected steps which has nothing to do with PDF Embedder.

NVD Source

Technical Analysis

CVE-2019-19589 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.

A successful exploit results in complete confidentiality breach (data exposure), full integrity compromise (data manipulation), availability disruption (denial of service), with a CVSS base score of 9.8.