Directory Traversal Vulnerability in Zephyr Project Manager for WordPress

CVE-2025-12496

What is CVE-2025-12496?

The Zephyr Project Manager plugin for WordPress is susceptible to a directory traversal vulnerability affecting all versions up to and including 3.3.203. This flaw allows authenticated users with custom-level access to exploit the 'file' parameter, potentially gaining unauthorized access to arbitrary files on the server. This could result in the exposure of sensitive information stored on the server. Furthermore, if the 'allow_url_fopen' directive is enabled, this vulnerability could enable Server-Side Request Forgery, escalating the security risk for vulnerable installations.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References