Unauthorized Data Access in ERI File Library for WordPress
CVE-2025-12041

5.3MEDIUM

Key Information:

Vendor

WordPress
Status
Eri File Library
Vendor
CVE Published:
31 October 2025

What is CVE-2025-12041?

The ERI File Library plugin for WordPress has a vulnerability that allows unauthorized access to sensitive data due to a lack of necessary capability checks on the 'erifl_file' AJAX action. This flaw affects all versions up to and including 1.1.0, enabling unauthenticated attackers to download files that should be restricted to designated user roles.

Affected Version(s)

ERI File Library * <= 1.1.0

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/changeset?sfp_email=&s...

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Athiwat Tiprasaharn
JSON
.
CVE-2025-12041 : Unauthorized Data Access in ERI File Library for WordPress