WordPress plugin
Zip Attachments security & vulnerabilities
Unpatched vulnerability in the latest version
At least one vulnerability affects the latest version and no fix has been released. Deactivate the plugin or restrict access to the affected feature until the vendor ships a patch.
- Critical0
- High1
- Medium2
- Low0
All Zip Attachments vulnerabilities
| Severity | Vulnerability | CVE | Published |
|---|---|---|---|
| High8.6 | Directory Traversal ≤1.5Update to 1.5.1 | CVE-2015-4694 |
- High8.6Directory Traversal
≤1.5Update to 1.5.1
Zip Attachments: common questions
Does Zip Attachments have known vulnerabilities?
Yes. VulnCrest Radar lists 3 known vulnerabilities in Zip Attachments: 1 high, 2 medium. At least one is not fixed in the latest version.
How do I check which version of Zip Attachments I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent Zip Attachments vulnerability?
CVE-2025-11701, published Oct 14, 2025: Zip Attachments <= 1.6 - Missing Authorization to Unauthenticated Private And Password-Protected Posts Attachment Disclosure. Severity: Medium (CVSS 5.3).
Is any Zip Attachments vulnerability listed in CISA KEV?
No. None of the known Zip Attachments vulnerabilities is currently listed in the CISA KEV catalog.