← Database

CVE-2025-12876

MEDIUM CVSS: 5.3 Published: 2025-12-05 Modified: 2026-06-17

Description

The Projectopia – WordPress Project Management plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the pto_delete_file AJAX action in all versions up to, and including, 5.1.19. This makes it possible for unauthenticated attackers to delete arbitrary attachments.

Affected Platforms

Unknown

Weakness Type

CWE-862

References