CVE-2025-2267

CVE-2025-2267 describes an arbitrary file download vulnerability in all versions of the WP01 WordPress plugin up to and including 2.6.2. This flaw, stemming from a missing capability check and insufficient restrictions on the make_archive() function, allows authenticated attackers with Subscriber-level access or higher to download and read arbitrary server files, potentially exposing sensitive information. The vulnerability carries a CVSS score of 6.5 (Medium), indicating a network-based attack with low attack complexity and requiring low privileges, leading to high confidentiality impact. Its EPSS score is low, suggesting a low likelihood of exploitation in the wild. Currently, there is no evidence of active exploitation, nor is public exploit code available on platforms like Metasploit or ExploitDB. Community discussion and media coverage for this CVE are minimal, consistent with a large percentage of reported vulnerabilities.