CVE-2025-11701: 
WordPress vulnerability analysis and mitigation

The Zip Attachments plugin for WordPress (versions up to 1.6) contains a vulnerability identified as CVE-2025-11701, discovered and disclosed on October 14, 2025. The vulnerability stems from missing authorization controls in the zacreatezip_callback function. This security flaw affects WordPress installations using the Zip Attachments plugin version 1.6 and earlier (NVD).

The vulnerability is characterized by a missing capability check and post status validation in the zacreatezip_callback function. It has been assigned a CVSS v3.1 base score of 5.3 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. The vulnerability is classified under CWE-862 (Missing Authorization) (Wordfence).

The vulnerability allows unauthenticated attackers to download attachments from private and password-protected posts, potentially exposing sensitive information that should be restricted. This unauthorized access to protected content compromises the confidentiality of data stored in private WordPress posts (NVD).

Users should upgrade to a version newer than 1.6 when available or consider implementing alternative solutions for handling file attachments. The vulnerability is present in the plugin's source code at the zacreatezip_callback function (WordPress Plugin).