CVE-2025-2267

Summary

CVE-2025-2267 is a vulnerability affecting the WP01 plugin for WordPress. This issue, present in versions 2.6.2 and below, allows authenticated attackers with Subscriber-level access or higher to download arbitrary files from the server due to a missing capability check and insufficient restrictions on the make_archive() function. The vulnerability poses a significant risk, as the downloaded files may contain sensitive information. Attackers can exploit this flaw to gain unauthorized access to critical data, potentially leading to serious security breaches. WordPress users are advised to update the WP01 plugin to the latest version as soon as possible to mitigate this risk.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.