{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-2267", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-03-12T19:27:07.155Z", "datePublished": "2025-03-15T03:23:23.948Z", "dateUpdated": "2026-04-08T17:06:41.018Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:06:41.018Z"}, "affected": [{"vendor": "wp01ru", "product": "WP01 \u2013 Speed, Security, SEO consultant", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "2.6.2", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The WP01 plugin for WordPress is vulnerable to Arbitrary File Download in all versions up to, and including, 2.6.2 due to a missing capability check and insufficient restrictions on the make_archive() function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to download and read the contents of arbitrary files on the server, which can contain sensitive information. CVE-2025-30567 is a duplicate of this issue."}], "title": "WP01 \u2013 Speed, Security, SEO consultant <= 2.6.2 - Authenticated (Subscriber+) Arbitrary File Download", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/900d09e8-ded5-49b9-81bf-ddfc85d3cf2b?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/wp01/trunk/inc/class-wp01.php#L109"}, {"url": "https://wordpress.org/plugins/wp01/"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-862 Missing Authorization", "cweId": "CWE-862", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "baseScore": 6.5, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Youcef Hamdani"}], "timeline": [{"time": "2025-03-14T14:25:22.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-03-17T21:25:23.308398Z", "id": "CVE-2025-2267", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-03-17T21:28:19.015Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-2267", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-03-17T21:25:23.308398Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-03-17T21:25:24.479Z"}}], "cna": {"title": "WP01 \u2013 Speed, Security, SEO consultant <= 2.6.2 - Authenticated (Subscriber+) Arbitrary File Download", "credits": [{"lang": "en", "type": "finder", "value": "Youcef Hamdani"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6.5, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"}}], "affected": [{"vendor": "wp01ru", "product": "WP01 \u2013 Speed, Security, SEO consultant", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "2.6.2"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-03-14T14:25:22.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/900d09e8-ded5-49b9-81bf-ddfc85d3cf2b?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/wp01/trunk/inc/class-wp01.php#L109"}, {"url": "https://wordpress.org/plugins/wp01/"}], "descriptions": [{"lang": "en", "value": "The WP01 plugin for WordPress is vulnerable to Arbitrary File Download in all versions up to, and including, 2.6.2 due to a missing capability check and insufficient restrictions on the make_archive() function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to download and read the contents of arbitrary files on the server, which can contain sensitive information. CVE-2025-30567 is a duplicate of this issue."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "CWE-862 Missing Authorization"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:06:41.018Z"}}}, "cveMetadata": {"cveId": "CVE-2025-2267", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:06:41.018Z", "dateReserved": "2025-03-12T19:27:07.155Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-03-15T03:23:23.948Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:wp01ru:wp01:*:*:*:*:*:wordpress:*:*", "matchCriteriaId": "C550DB10-29F2-4FF6-9EB2-127B9A3CDBCD", "versionEndIncluding": "2.6.2", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The WP01 plugin for WordPress is vulnerable to Arbitrary File Download in all versions up to, and including, 2.6.2 due to a missing capability check and insufficient restrictions on the make_archive() function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to download and read the contents of arbitrary files on the server, which can contain sensitive information. CVE-2025-30567 is a duplicate of this issue."}, {"lang": "es", "value": "El complemento WP01 para WordPress es vulnerable a la descarga arbitraria de archivos en todas las versiones hasta la 2.6.2 incluida, debido a la falta de una comprobaci\u00f3n de capacidad y a restricciones insuficientes en la funci\u00f3n make_archive(). Esto permite que atacantes autenticados, con acceso de suscriptor o superior, descarguen y lean el contenido de archivos arbitrarios en el servidor, que pueden contener informaci\u00f3n confidencial."}], "id": "CVE-2025-2267", "lastModified": "2026-04-08T18:24:34.090", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "security@wordfence.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2025-03-15T04:15:22.443", "references": [{"source": "security@wordfence.com", "tags": ["Product"], "url": "https://plugins.trac.wordpress.org/browser/wp01/trunk/inc/class-wp01.php#L109"}, {"source": "security@wordfence.com", "tags": ["Product"], "url": "https://wordpress.org/plugins/wp01/"}, {"source": "security@wordfence.com", "tags": ["Third Party Advisory"], "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/900d09e8-ded5-49b9-81bf-ddfc85d3cf2b?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "security@wordfence.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-22T01:54:02.532211+00:00", "value": {"mitigation_remediation": ["Update the WP01 plugin to the latest version (>= 2.6.3) which adds proper capability checks.", "If an immediate update is not possible, deactivate or uninstall the WP01 plugin to remove the vulnerable code path.", "Ensure WordPress file permissions restrict web\u2011server read access to only files necessary for normal operation, limiting potential data exposure from any remaining code."], "summary": {"action": "Apply Patch", "impact": "Arbitrary File Download"}, "threat_synthesis": {"affected_systems": "All installations of the WP01 \u2013 Speed, Security, SEO consultant plugin for WordPress, from all vendor releases up to and including version 2.6.2. The flaw exists in plugin files under the wp01 directory on any WordPress site that has not yet upgraded beyond that version.", "description_and_impact": "The WP01 plugin contains a missing capability verification and unrestricted use of the make_archive function, allowing authenticated users with Subscriber-level access to trigger arbitrary file downloads from the server. This flaw permits the attacker to read file contents that may hold sensitive data, leading to confidentiality compromise. The weakness maps to CWE-862: Permissions Error.", "risk_and_exploitability": "The CVSS base score of 6.5 indicates medium severity. The EPSS score of less than 1% reflects a low probability that this vulnerability is actively exploited in the wild. The flaw is not listed in the CISA KEV catalog. Exploitation requires a logged\u2011in user with at least Subscriber rights; such a user can supply a crafted request to the make_archive endpoint to download any file located on the server\u2019s file system that the web server process can read. This attack does not appear to require additional privileges or a separate vulnerability, and therefore the risk to any compromised site is significant while the likelihood remains low under current public data."}}}}, "created": "2026-04-22T02:00:05.038968+00:00", "updated": "2026-04-22T02:00:05.038978+00:00", "vendors": []}