CVE-2025-11701: Zip Attachments Auth Bypass Vulnerability

CVE-2025-11701 Overview

CVE-2025-11701 affects the Zip Attachments plugin for WordPress in all versions up to and including 1.6. The vulnerability stems from a missing capability check and missing post status validation in the za_create_zip_callback function. Unauthenticated attackers can download attachments from private and password-protected posts without authorization. The flaw falls under the [CWE-862] Missing Authorization weakness class.

Critical Impact
Unauthenticated remote attackers can retrieve attachments from private and password-protected WordPress posts, resulting in confidentiality loss for content that site owners restricted from public access.

Affected Products

Zip Attachments plugin for WordPress (all versions ≤ 1.6)
WordPress sites using Zip Attachments to bundle post attachments
Sites relying on WordPress post visibility controls (private, password-protected)

Discovery Timeline

2025-10-15 - CVE-2025-11701 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-11701

Vulnerability Analysis

The Zip Attachments plugin exposes a callback function, za_create_zip_callback, that assembles a ZIP archive of files attached to a WordPress post and returns it to the requester. The function services requests without verifying the caller's WordPress capabilities and without validating the target post's status. As a result, the endpoint treats requests for private posts and password-protected posts identically to requests for public posts.

An unauthenticated attacker who knows or guesses a post ID can invoke the callback and receive the associated attachments packaged as a ZIP. Content that authors marked as private or protected with a password is disclosed even though WordPress' native access controls would otherwise block direct rendering. The impact is limited to confidentiality: integrity and availability of the site are unaffected.

Root Cause

The root cause is two related access control omissions in za_create_zip_callback. First, the handler does not call a WordPress capability check such as current_user_can() before processing the request. Second, it does not inspect the post status returned by get_post() to reject requests targeting private posts or posts with a non-empty post_password. The plugin source is available in the WordPress plugin repository.

Attack Vector

Exploitation requires only network access to the target WordPress site. The attacker issues an HTTP request to the plugin's public AJAX or REST endpoint with a target post ID. No authentication, user interaction, or elevated privileges are required. Post IDs can be enumerated sequentially or discovered through sitemaps, feeds, and other reconnaissance sources.

See the Wordfence vulnerability report for additional technical detail on the callback flow.

Detection Methods for CVE-2025-11701

Indicators of Compromise

Unauthenticated HTTP requests to the Zip Attachments plugin endpoint referencing za_create_zip_callback or the plugin's action parameter.
Successful ZIP downloads returned for post IDs whose posts have post_status = 'private' or a non-empty post_password.
Repeated requests iterating through sequential post IDs from a single source address.

Detection Strategies

Review web server access logs for requests to admin-ajax.php or REST routes that reference the Zip Attachments action parameter and lack an authenticated session cookie.
Cross-reference download events against the WordPress wp_posts table to identify requests that resulted in delivery of private or password-protected content.
Alert on high-volume enumeration of post IDs from a single client, which indicates scraping of restricted attachments.

Monitoring Recommendations

Enable WordPress access logging and forward logs to a central SIEM for correlation across sites.
Monitor outbound response sizes for the plugin endpoint; ZIP payloads are larger than typical AJAX responses and are a useful anomaly signal.
Track user-agent and source IP diversity against the plugin endpoint to detect automated abuse.

How to Mitigate CVE-2025-11701

Immediate Actions Required

Deactivate the Zip Attachments plugin on any WordPress site running version 1.6 or earlier until a fixed release is installed.
Audit wp_posts for private and password-protected posts containing sensitive attachments and rotate or replace any material that may have been exposed.
Restrict access to admin-ajax.php and REST endpoints for the plugin at the web application firewall while a fix is pending.

Patch Information

At the time of the NVD publication, all versions up to and including 1.6 are affected. Site administrators should monitor the Zip Attachments plugin page and the Wordfence advisory for release of a patched version and upgrade as soon as it becomes available.

Workarounds

Block requests to the plugin's callback action at the WAF or reverse proxy by matching the plugin's action parameter value.
Remove or rename the plugin directory in wp-content/plugins/zip-attachments/ if the ZIP download feature is not business-critical.
Move sensitive attachments out of the WordPress media library into an access-controlled storage location that enforces authentication independently.

bash

# Example nginx rule to block the vulnerable AJAX action
location = /wp-admin/admin-ajax.php {
    if ($arg_action = "za_create_zip") {
        return 403;
    }
    include fastcgi_params;
    fastcgi_pass php_upstream;
}