CVE-2025-12041
BaseFortify
Publication date: 2025-10-31
Last updated on: 2025-11-04
Assigner: Wordfence
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| eri-file-library | eri-file-library | 1.1.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-862 | The product does not perform an authorization check when an actor attempts to access a resource or perform an action. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability in the ERI File Library WordPress plugin (version 1.1.0 and earlier) is due to a missing capability check on the 'erifl_file' AJAX action. This flaw allows unauthenticated attackers to download files that should be restricted to specific user roles, effectively enabling unauthorized access to protected files. [2]
How can this vulnerability impact me? :
The vulnerability can impact you by allowing unauthorized users to access and download files that are meant to be restricted to certain user roles. This could lead to exposure of sensitive or private data, potentially causing data leaks or misuse of information. [2]
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
This vulnerability could negatively affect compliance with standards like GDPR and HIPAA because unauthorized access to restricted files may lead to exposure of personal or sensitive data, violating data protection and privacy requirements mandated by these regulations. [2]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by monitoring AJAX requests to the 'erifl_file' action in the WordPress eri-file-library plugin. Specifically, look for unauthorized or unauthenticated AJAX requests attempting to download files. You can use network traffic inspection tools like tcpdump or Wireshark to capture HTTP POST requests to admin-ajax.php with the action parameter set to 'erifl_file'. For example, using tcpdump: tcpdump -i any -A -s 0 'tcp port 80 or tcp port 443' | grep 'action=erifl_file'. Additionally, checking web server logs for repeated or unusual access patterns to admin-ajax.php with this action may help identify exploitation attempts.
What immediate steps should I take to mitigate this vulnerability?
The immediate mitigation step is to update the eri-file-library WordPress plugin to version 1.1.1 or later, which includes a fix that adds proper capability checks to the AJAX file download action, preventing unauthorized access. This update also adds a rate limiter to control download frequency and improves nonce verification for AJAX requests. If updating immediately is not possible, consider restricting access to admin-ajax.php or the specific AJAX action via firewall rules or other access controls to prevent unauthenticated requests. [2]