Medium severity4.9NVD Advisory· Published Dec 17, 2025· Updated Apr 15, 2026

CVE-2025-12496

Description

The Zephyr Project Manager plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 3.3.203 via the file parameter. This makes it possible for authenticated attackers, with Custom-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information. On a servers that have allow_url_fopen enabled, this issue allows for Server-Side Request Forgery

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Zephyr Project Manager Project/Zephyr Project Managerllm-fuzzy
Range: <=3.3.203
WordPress/Zephyr Project Managerwp-canonicalize
Package: https://wordpress.org/plugins/zephyr-project-manager

Patches

Vulnerability mechanics

References

plugins.trac.wordpress.org/browser/zephyr-project-manager/trunk/includes/Base/AjaxHandler.phpnvd
plugins.trac.wordpress.org/browser/zephyr-project-manager/trunk/includes/Core/Projects.phpnvd
www.wordfence.com/threat-intel/vulnerabilities/id/2b4b0640-d61a-4969-a5c0-d2d709fb56d0nvd

News mentions

No linked articles in our index yet.

cvss	0.319
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000