CVE-2025-11692

MediumCVSS 5.3/10Last modified Oct 8, 2026

Description

The Zip Attachments plugin for WordPress is vulnerable to unauthorized loss of data due to a missing authorization and capability checks on the download.php file in all versions up to, and including, 1.6. This makes it possible for unauthenticated attackers to delete arbitrary files from the current wp_upload_dir directory.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-862

Affected software

No affected versions have been published.

Timeline

Published: Oct 15, 2025
Last modified: Oct 8, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-116939.8The Export WP Page to Static HTML & PDF plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and incl CVE-2025-116948.7A security issue exists within 1769 CompactLogix controllers due to the missing validation of sequence numbers and source IP addresses in th CVE-2025-116957.5When tlsInsecure=False appears in a connection string, certificate validation is disabled. This vulnerability affects MongoDB Rust Driver v CVE-2025-116968.9A local server-side request forgery (SSRF) security issue exists within Studio 5000® Simulation Interface™ via the API. This vulnerability a CVE-2025-116978.9A local code execution security issue exists within Studio 5000® Simulation Interface™ via the API. This vulnerability allows any Windows us CVE-2025-116989.2A denial-of-service issue exists in 5380/5480/5580 controllers boot firmware lower than version 1.072. This vulnerability could potentially CVE-2025-116997.1nopCommerce v4.70 and prior, and version 4.80.3, does not invalidate session cookies after logout or session termination, allowing an attack CVE-2025-11705.4A vulnerability classified as problematic has been found in code-projects Real Estate Property Management System 1.0. Affected is an unknown CVE-2025-117007.5N-central versions < 2025.4 are vulnerable to multiple XML External Entities injection leading to information disclosure CVE-2025-117015.3The Zip Attachments plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check as well as missing p CVE-2025-117028.8GitLab has remediated an issue in EE affecting all versions from 17.1 before 18.3.5, 18.4 before 18.4.3, and 18.5 before 18.5.1 that could h CVE-2025-117035.3The WP Go Maps (formerly WP Google Maps) plugin for WordPress is vulnerable to Cache Poisoning in all versions up to, and including, 9.0.48.