Medium severity4.9NVD Advisory· Published Dec 17, 2025· Updated Apr 15, 2026

CVE-2025-12496

Description

The Zephyr Project Manager plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 3.3.203 via the file parameter. This makes it possible for authenticated attackers, with Custom-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information. On a servers that have allow_url_fopen enabled, this issue allows for Server-Side Request Forgery

Affected products

Zephyr Project Manager Project/Zephyr Project Managerllm-fuzzy
Range: <=3.3.203

Patches

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

plugins.trac.wordpress.org/browser/zephyr-project-manager/trunk/includes/Base/AjaxHandler.phpnvd
plugins.trac.wordpress.org/browser/zephyr-project-manager/trunk/includes/Core/Projects.phpnvd
www.wordfence.com/threat-intel/vulnerabilities/id/2b4b0640-d61a-4969-a5c0-d2d709fb56d0nvd

News mentions

No linked articles in our index yet.

cvss	0.319
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000