PT-2025-44597 · WordPress · Eri File Library

Athiwat Tiprasaharn · Published 2025-10-31 · Updated 2025-10-31 · CVE-2025-12041

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions ERI File Library plugin for WordPress versions up to and including 1.1.0

Description The ERI File Library plugin for WordPress has a flaw that allows unauthorized access to data. This is due to a missing capability check on the erifl file AJAX action. Unauthenticated attackers can potentially download files restricted to specific user roles.

Recommendations Update the ERI File Library plugin to a version newer than 1.1.0.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2025-12041

Affected Products

Eri File Library

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2025-12041 · Security Note
• https://wordfence.com/threat-intel/vulnerabilities/id/16e1d37a-4eb7-45dc-8993-a501fb2aaf73?source=cve · Note
• https://t.me/cveNotify/141093 · Telegram Post
• https://twitter.com/CVEnew/status/1984211889120034992 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1984231942666022945 · Twitter Post
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3385895%40eri-file-library&new=3385895%40eri-file-library · Note