BaseFortify

Publication date: 2025-10-15

Last updated on: 2025-10-16

Assigner: Wordfence

Description

The Zip Attachments plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check as well as missing post status validation in the za_create_zip_callback function in all versions up to, and including, 1.6. This makes it possible for unauthenticated attackers to download attachments from private and password-protected posts.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-10-15

Last Modified

2025-10-16

Generated

2026-07-06

AI Q&A

2025-10-15

EPSS Evaluated

2026-07-05

NVD

CVE-2025-11701

EUVD

EUVD-2025-34537

Affected Vendors & Products

Vendor	Product	Version / Range
wordpress	zip_attachments	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

This vulnerability exists in the Zip Attachments plugin for WordPress, where due to missing capability checks and missing post status validation in the za_create_zip_callback function (in all versions up to and including 1.6), unauthenticated attackers can download attachments from private and password-protected posts.

Impact Analysis

The vulnerability allows unauthenticated attackers to access and download attachments from private and password-protected posts, potentially exposing sensitive or confidential data without authorization.

Hi! I’m here to help you understand CVE-2025-11701. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70