CVE-2025-12041: WordPress ERI File Library Auth Bypass

CVE-2025-12041 Overview

CVE-2025-12041 affects the ERI File Library plugin for WordPress in all versions up to and including 1.1.0. The plugin fails to enforce a capability check on the erifl_file AJAX action. Unauthenticated attackers can invoke this action to download files that should be restricted to specific user roles. The weakness is classified as Missing Authorization [CWE-862] and is exploitable over the network without user interaction.

Critical Impact
Unauthenticated remote attackers can retrieve role-restricted files from vulnerable WordPress sites, resulting in confidentiality loss for content the site owner intended to gate behind user role permissions.

Affected Products

ERI File Library plugin for WordPress, versions up to and including 1.1.0
WordPress sites that expose the erifl_file AJAX action
Any deployment relying on the plugin's role-based file access controls

Discovery Timeline

2025-10-31 - CVE-2025-12041 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-12041

Vulnerability Analysis

The ERI File Library plugin registers an AJAX handler bound to the erifl_file action. Handlers of this type run within the standard wp-admin/admin-ajax.php endpoint and must validate the caller's capability before returning protected resources. In vulnerable releases through 1.1.0, the handler skips this capability check entirely.

Because the action is also hooked into the wp_ajax_nopriv_ variant, unauthenticated visitors can invoke it directly. The handler proceeds to serve files that the plugin's UI would otherwise restrict to authorized user roles. The result is broken access control on the file delivery path.

The issue does not require credentials, tokens, or user interaction. Impact is limited to confidentiality because the flaw exposes files but does not modify state or disrupt availability.

Root Cause

The root cause is a missing authorization check [CWE-862] in the erifl_file AJAX handler. The code does not call current_user_can() or an equivalent capability gate before returning the requested file. Role assignments configured through the plugin's administrative interface are therefore not enforced at the request handler layer.

Attack Vector

An attacker sends an HTTP request to admin-ajax.php with action=erifl_file and the parameters needed to identify a target file. No session cookie or nonce is required. The server responds with the file contents, bypassing the intended role restriction. See the Wordfence Vulnerability Report and the WordPress Plugin Changeset for the underlying source change.

Detection Methods for CVE-2025-12041

Indicators of Compromise

Unauthenticated POST or GET requests to /wp-admin/admin-ajax.php containing action=erifl_file
Repeated file identifier enumeration in access logs from a single source IP
File downloads served by admin-ajax.php with no accompanying authenticated session cookie

Detection Strategies

Alert on requests to admin-ajax.php where action=erifl_file and no wordpress_logged_in_* cookie is present
Baseline legitimate usage of the plugin and flag deviations in request volume or source geography
Correlate web server access logs with WordPress user session data to identify unauthenticated file retrievals

Monitoring Recommendations

Forward WordPress and web server logs to a centralized log platform for retention and query
Track admin-ajax.php response sizes to identify bulk exfiltration patterns
Review installed plugin inventories to confirm the ERI File Library version deployed across all WordPress instances

How to Mitigate CVE-2025-12041

Immediate Actions Required

Update the ERI File Library plugin to a version above 1.1.0 that includes the capability check fix
Audit access logs for prior invocations of the erifl_file AJAX action from unauthenticated sources
Rotate or revoke access to any files whose confidentiality depended on the plugin's role restrictions

Patch Information

The fix is committed in the plugin's source repository, referenced in the WordPress Plugin Changeset. Administrators should upgrade to the patched release available through the WordPress plugin directory.

Workarounds

Deactivate the ERI File Library plugin until the patched version is installed
Block unauthenticated requests to admin-ajax.php with action=erifl_file at the web application firewall
Restrict access to protected file directories at the web server layer using authentication rules independent of the plugin

bash

# Example WAF rule to block unauthenticated erifl_file requests
# Adjust syntax to match your WAF or reverse proxy
SecRule REQUEST_URI "@contains /wp-admin/admin-ajax.php" \
  "chain,deny,status:403,id:1012041,msg:'Block unauth ERI File Library access'"
  SecRule ARGS:action "@streq erifl_file" "chain"
    SecRule &REQUEST_COOKIES:/wordpress_logged_in_/ "@eq 0"