Arbitrary File Download Vulnerability in WP01 Plugin for WordPress

CVE-2025-2267

What is CVE-2025-2267?

The WP01 plugin for WordPress is susceptible to an Arbitrary File Download vulnerability due to inadequate capability verification and improper restrictions on the make_archive() function. This security flaw enables authenticated attackers with Subscriber-level access or higher to download and access arbitrary files on the server, which potentially exposes sensitive data. The issue persists in all versions up to and including 2.6.2, requiring immediate attention to safeguard server integrity.

References