Vulnerability · Published Oct 15, 2025 · Assigned by Wordfence
CVE-2025-11701Zip Attachments <= 1.6 - Missing Authorization to Unauthenticated Private And Password-Protected Posts Attachment Disclosure
Medium 5.3
In plain English
A medium-severity missing authorization in Zip Attachments from quicoto. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 21% of all known vulnerabilities).
Official description
The Zip Attachments plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check as well as missing post status validation in the za_create_zip_callback function in all versions up to, and including, 1.6. This makes it possible for unauthenticated attackers to download attachments from private and password-protected posts.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| quicoto | Zip Attachments | 0 – through 1.6 |
Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N