Zephyr Project Manager CVE-2025-12496

Requires an authenticated account holding the plugin's 'Custom' level access or above on a site running Zephyr Project Manager <=3.3.203; the attacker sends a traversal payload via the file parameter to the plugin's AJAX handler. Primary impact is arbitrary file read (confidentiality). The SSRF escalation is gated on a specific server configuration - PHP's allow_url_fopen must be enabled - and does not apply otherwise. The PR:H authentication requirement (non-anonymous, elevated plugin role) is the principal limiting factor; no user interaction is needed.

This is a genuine but modest-priority issue. The provided CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N = 4.9 Medium) describes network-reachable, low-complexity exploitation with no user interaction, but requires elevated privileges (PR:H) - the description clarifies this as 'Custom-level access and above', a plugin-managed role rather than a fully anonymous attacker, which meaningfully limits the population of potential attackers. Impact is confidentiality-only (C:H, I:N, A:N): arbitrary file read that can expose wp-config.php credentials, secrets, or other sensitive server files, with an optional escalation to SSRF only where the server has allow_url_fopen enabled. No EPSS score, no CISA KEV entry, and no public POC were provided in the intelligence, so exploitation status is 'no public exploit identified at time of analysis'. There is no signal conflict: the CVSS network vector is consistent with a WordPress AJAX-handler traversal reachable over HTTP. The main caveat is that the SSRF impact is conditional (allow_url_fopen), and PR:H already gates the primary file-read, so real-world risk skews lower than the raw CWE-22 'arbitrary file read' phrasing suggests.

An attacker who holds a Zephyr Project Manager 'Custom' (or higher) role on a WordPress site sends a crafted authenticated AJAX request with a path-traversal payload in the file parameter to read wp-config.php or other sensitive files off the server. Where PHP's allow_url_fopen is enabled, the same parameter can be pointed at an internal URL to coerce server-side requests (SSRF). No public exploit code was identified at time of analysis, though the Wordfence advisory pinpoints the vulnerable handler in AjaxHandler.php.