Unauthorized Data Access in Zip Attachments Plugin for WordPress

CVE-2025-11701

What is CVE-2025-11701?

The Zip Attachments plugin for WordPress lacks proper capability checks and post status validation in the za_create_zip_callback function. As a result, this allows unauthenticated attackers to gain unauthorized access to sensitive attachments from private or password-protected posts, leading to potential data leaks and exposing confidential information.

References