PT-2025-51819 · WordPress · Zephyr Project Manager

Dylanjkotze · Published 2025-12-17 · Updated 2025-12-17 · CVE-2025-12496

Positive Technologies (AI Summary)

CVSS v3.1

4.9

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Zephyr Project Manager versions prior to 3.3.204

Description The Zephyr Project Manager plugin for WordPress is susceptible to a Directory Traversal issue via the file parameter. This allows authenticated attackers with Custom-level access or higher to read arbitrary files on the server, potentially exposing sensitive information. If allow url fopen is enabled on the server, this issue can also lead to Server-Side Request Forgery.

Recommendations Update Zephyr Project Manager to version 3.3.204 or later.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2025-12496

Affected Products

Zephyr Project Manager

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2025-12496 · Security Note
• https://t.me/CVEtracker/40040 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2001232127224852483 · Twitter Post
• https://plugins.trac.wordpress.org/browser/zephyr-project-manager/trunk/includes/Core/Projects.php#L1870 · Note
• https://plugins.trac.wordpress.org/browser/zephyr-project-manager/trunk/includes/Base/AjaxHandler.php#L3506 · Note
• https://twitter.com/CVEnew/status/2001350817543250067 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/2b4b0640-d61a-4969-a5c0-d2d709fb56d0?source=cve · Note
• https://t.me/cveNotify/146064 · Telegram Post