Arbitrary File Download Vulnerability in WP01 Plugin for WordPress

CVE-2025-2267

What is CVE-2025-2267?

The WP01 plugin for WordPress is susceptible to an Arbitrary File Download vulnerability due to inadequate capability verification and improper restrictions on the make_archive() function. This security flaw enables authenticated attackers with Subscriber-level access or higher to download and access arbitrary files on the server, which potentially exposes sensitive data. The issue persists in all versions up to and including 2.6.2, requiring immediate attention to safeguard server integrity.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References