CVE-2025-11701
Last modified
CVE-2025-11701 is a medium-severity vulnerability rated 5.3/10 on the CVSS scale. The Zip Attachments plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check as well as missing post status validation in the za_create_zip_callback function in all versions up to, and including, 1.6. This makes it possible for unauthenticated attackers to download attachments from private and password-protected posts.. EPSS estimates a 0.26% chance of exploitation in the next 30 days.
Description
The Zip Attachments plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check as well as missing post status validation in the za_create_zip_callback function in all versions up to, and including, 1.6. This makes it possible for unauthenticated attackers to download attachments from private and password-protected posts.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weakness Enumeration
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2025-11701?
How severe is CVE-2025-11701?
How do I fix CVE-2025-11701?
How Strix Helps
- Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2025
- CVE-2025-11696A local server-side request forgery (SSRF) security issue ex…8.9
- CVE-2025-11697A local code execution security issue exists within Studio 5…8.9
- CVE-2025-11698A denial-of-service issue exists in 5380/5480/5580 controlle…9.2
- CVE-2025-11699nopCommerce v4.70 and prior, and version 4.80.3, does not in…7.1
- CVE-2025-1170A vulnerability classified as problematic has been found in …5.4
- CVE-2025-11700N-central versions < 2025.4 are vulnerable to multiple XML E…7.5
- CVE-2025-11702GitLab has remediated an issue in EE affecting all versions …8.8
- CVE-2025-11703The WP Go Maps (formerly WP Google Maps) plugin for WordPres…5.3
- CVE-2025-11704The Elegance Menu plugin for WordPress is vulnerable to Loca…7.5
- CVE-2025-11705The Anti-Malware Security and Brute-Force Firewall plugin fo…6.5
- CVE-2025-11706The Aruba HiSpeed Cache plugin for WordPress is vulnerable t…6.1
- CVE-2025-11707The Login Lockdown & Protection plugin for WordPress is vuln…5.3
Are you affected by CVE-2025-11701?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST