Medium severity6.5NVD Advisory· Published Mar 15, 2025· Updated Apr 8, 2026

CVE-2025-2267

Description

The WP01 plugin for WordPress is vulnerable to Arbitrary File Download in all versions up to, and including, 2.6.2 due to a missing capability check and insufficient restrictions on the make_archive() function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to download and read the contents of arbitrary files on the server, which can contain sensitive information. CVE-2025-30567 is a duplicate of this issue.

Affected products

WordPress/Wp01references
Package: https://wordpress.org/plugins/wp01

Patches

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

www.wordfence.com/threat-intel/vulnerabilities/id/900d09e8-ded5-49b9-81bf-ddfc85d3cf2bnvdThird Party Advisory
plugins.trac.wordpress.org/browser/wp01/trunk/inc/class-wp01.phpnvdProduct
wordpress.org/plugins/wp01/nvdProduct

News mentions

No linked articles in our index yet.

cvss	0.423
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000