What is CVE-2025-11692?

CVE-2025-11692 is a medium-severity vulnerability in Quicoto Zip Attachments, classified under Missing Authorization. CVSS score: 5.3/10. Published 2025-10-15.

How severe is CVE-2025-11692?

Medium severity. CVSS v3 base score is 5.3 out of 10.

Auth bypass in Quicoto Zip Attachments

CVE-2025-11692

The Zip Attachments plugin for WordPress is vulnerable to unauthorized loss of data due to a missing authorization and capability checks on the download.php file in all versions up to, and including, 1.6. This makes it possible for unauthenticated attackers to delete arbitrary files from the current wp_upload_dir directory.

Vulnerability class: Broken Access Control

EPSS: 0.002 (13.2th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 5.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N.

Affected products

Quicoto Zip Attachments — versions 0

Weakness classification (CWE)

CWE-862 — Missing Authorization

References

Frequently asked questions

What is CVE-2025-11692?: CVE-2025-11692 is a medium-severity vulnerability in Quicoto Zip Attachments, classified under Missing Authorization. CVSS score: 5.3/10. Published 2025-10-15.
How severe is CVE-2025-11692?: Medium severity. CVSS v3 base score is 5.3 out of 10.