Security Alert Summary
The Zephyr Project Manager plugin for WordPress contains a directory traversal vulnerability via the file parameter in all versions up to and including 3.3.203. An authenticated attacker with Custom-level access or higher can read arbitrary files on the server. On servers with PHP’s allow_url_fopen enabled, this issue can also enable server-side request forgery (SSRF) behavior.
CVE Details
- CVE ID: CVE-2025-12496
- Affected component: Zephyr Project Manager plugin for WordPress
- Affected versions: All versions up to and including 3.3.203
- Published: December 17, 2025 at 8:15:42 AM
- Last modified: December 17, 2025 at 8:15:42 AM
- CVSS v3.1: Base Score 4.9 (MEDIUM) — Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
- Authentication / privileges / user interaction: Authentication required; Privileges required: High (Custom-level access or higher); User interaction: None
- Primary impact: Confidentiality: High; Integrity: None; Availability: None
- CWE: CWE-22 (Path Traversal)
Technical Details
The vulnerability is a directory traversal flaw using the file parameter. When this parameter is not properly validated or sanitized, an authenticated user with sufficient privileges can traverse directories to read files outside the intended scope. The CVE states this affects all versions up to and including 3.3.203.
The CVE also notes that on servers where PHP’s allow_url_fopen is enabled, the same input vector can be used to trigger server-side request forgery (SSRF) behavior by requesting remote resources. The CVE description does not specify a named function or REST endpoint in its text; references point to plugin source lines but no specific function name is provided in the CVE entry.
How This Could Impact Your Website
Imagine a site owner who assigns project management duties to an internal staff member and an external contractor. If either of those users has Custom-level access (or higher) and the site is running an affected version of the plugin, they could use the vulnerability to read arbitrary server files. Those files might include configuration files, backups, or exported reports that contain sensitive data such as database connection details or user contact information.
Access to internal email addresses and other contact details increases the risk of targeted phishing or social engineering against staff and contributors. Where allow_url_fopen is enabled, the ability to make server-side requests to remote locations adds another dimension to potential data exposure.
If you’re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review.
Recommended Actions
- Update the affected plugin as soon as a patched version is available. (The CVE entry does not specify a fixed or patched version.)
- Review and reduce unnecessary user roles and privileges, especially for contributor-type accounts and other non-administrator users.
- Enforce strong passwords and enable two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins from your site.
- Monitor site and server logs for unusual file access or unexpected requests.
If you’d like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
References
- https://plugins.trac.wordpress.org/browser/zephyr-project-manager/trunk/includes/Base/AjaxHandler.php#L3506
- https://plugins.trac.wordpress.org/browser/zephyr-project-manager/trunk/includes/Core/Projects.php#L1870
- https://www.wordfence.com/threat-intel/vulnerabilities/id/2b4b0640-d61a-4969-a5c0-d2d709fb56d0?source=cve
