CVE-2025-11701 affects the Zip Attachments WordPress plugin by lacking capability checks and post status validation in the za_create_zip_callback function. This missing authorization enables unauthenticated users to access and download attachments from posts that are intended to be private or password-protected. The vulnerability impacts all versions up to and including 1.6 of the plugin. The CVSS 3.1 base score is 5.3, reflecting a medium severity with network attack vector, low attack complexity, no privileges required, and no user interaction needed. There is no evidence of known exploits in the wild or an official patch at this time.

An attacker without authentication can exploit this vulnerability to download attachments from private or password-protected posts, potentially exposing sensitive or restricted content. The impact is limited to confidentiality loss of attachment data. There is no indication of integrity or availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, administrators should consider disabling the Zip Attachments plugin or restricting access to it via other means to prevent unauthorized downloads. Monitoring for updates from the plugin vendor is recommended.