CVE-2025-12041 identifies a missing authorization vulnerability (CWE-862) in the apos37 ERI File Library WordPress plugin, versions up to and including 1.1.0. The flaw exists because the plugin fails to perform a capability check on the 'erifl_file' AJAX action, which is responsible for serving files restricted to certain user roles. This omission allows unauthenticated attackers to invoke the AJAX action remotely and download files that should be protected, leading to unauthorized data disclosure. The vulnerability affects confidentiality but does not impact data integrity or system availability. The attack vector is network-based with low attack complexity, requiring no privileges or user interaction. Although no public exploits have been reported, the vulnerability’s presence in a widely used CMS plugin increases the risk of exploitation. The CVSS 3.1 base score of 5.3 reflects these factors. The vulnerability is particularly concerning for organizations that store sensitive or proprietary files accessible via this plugin. Since WordPress powers a significant portion of websites globally, including many in Europe, the exposure risk is notable. The lack of a patch at the time of publication necessitates interim mitigations to prevent unauthorized access.

For European organizations, this vulnerability primarily threatens the confidentiality of sensitive files managed through the ERI File Library plugin on WordPress sites. Unauthorized disclosure could lead to leakage of proprietary information, customer data, or internal documents, potentially resulting in reputational damage, regulatory penalties under GDPR, and loss of competitive advantage. Since the vulnerability does not affect integrity or availability, operational disruption is unlikely. However, the ease of exploitation without authentication increases the risk of opportunistic attacks, especially against public-facing websites. Organizations in sectors such as finance, healthcare, and government, which often handle sensitive data, are at heightened risk. The exposure could also facilitate further attacks if sensitive configuration or credential files are accessed. Given the widespread use of WordPress in Europe, the vulnerability could impact a broad range of organizations, from SMEs to large enterprises.

Immediate mitigation should focus on restricting access to the vulnerable AJAX endpoint. Web application firewalls (WAFs) can be configured to block or monitor requests to the 'erifl_file' AJAX action, especially those originating from unauthenticated sources. Organizations should audit their WordPress installations to identify the presence of the apos37 ERI File Library plugin and assess the exposure of sensitive files. Until an official patch is released, disabling or removing the plugin can eliminate the risk. Implementing strict file permissions and ensuring sensitive files are not stored in publicly accessible directories can reduce impact. Monitoring web server logs for unusual access patterns to the AJAX endpoint can help detect exploitation attempts. Additionally, organizations should maintain up-to-date backups and prepare incident response plans to address potential data breaches. Once a patch becomes available, prompt application is critical. Finally, educating site administrators about the risks of unauthorized file access and secure plugin management is recommended.