Directory Traversal Vulnerability in Zephyr Project Manager for WordPress

CVE-2025-12496

What is CVE-2025-12496?

The Zephyr Project Manager plugin for WordPress is susceptible to a directory traversal vulnerability affecting all versions up to and including 3.3.203. This flaw allows authenticated users with custom-level access to exploit the 'file' parameter, potentially gaining unauthorized access to arbitrary files on the server. This could result in the exposure of sensitive information stored on the server. Furthermore, if the 'allow_url_fopen' directive is enabled, this vulnerability could enable Server-Side Request Forgery, escalating the security risk for vulnerable installations.

References