CVE-2025-11692CWE-862broken-access-control

CVE-2025-11692

Medium · published October 15, 2025

CVSS v3.1

5.3

EPSS

Percentile

14.3

In the wild

Unconfirmed

What it is

The Zip Attachments plugin for WordPress is vulnerable to unauthorized loss of data due to a missing authorization and capability checks on the download.php file in all versions up to, and including, 1.6. This makes it possible for unauthenticated attackers to delete arbitrary files from the current wp_upload_dir directory.

The record

Technical detail

CVSS v3.1: 5.3 · MEDIUM
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CVSS v4.0: Not supplied
EPSS: 0.00240 · 14.3th percentile
Weakness: CWE-862 · Missing Authorization
Published: 2025-10-15T13:15Z

References (2)

https://plugins.trac.wordpress.org/browser/zip-attachments/tags/1.6/download.php#L27 · [email protected]https://www.wordfence.com/threat-intel/vulnerabilities/id/aa8d746f-82e2-4615-92bb-35d20124dc56?source=cve · [email protected]

EPSS history

Timeline

15 OCT 08:25Z
Zip Attachments <= 1.6 - Missing Authorization to Limited File Deletion
cvelistv5