The Zip Attachments plugin for WordPress is vulnerable because the za_create_zip_callback function lacks a capability check and does not validate the post status. This missing protection allows any unauthenticated user to trigger the function and download attachments that belong to private or password-protected posts. The vulnerability directly exposes private content without modifying the integrity of the site, leading to confidential data leakage.

Quicoto’s Zip Attachments plugin, all versions up to and including 1.6, is affected. Users running any of these versions are vulnerable unless the plugin has been patched or removed.

The CVSS score of 5.3 indicates a moderate severity. The EPSS score is below 1%, suggesting a low probability of exploitation at the current time. The vulnerability is not listed in CISA’s KEV catalog, so no known widespread attacks have been reported. Based on the description, the likely attack vector is an unauthenticated HTTP request to the plugin’s zip endpoint. Attackers can download the ZIP file without any authentication or authorization checks, which circumvents the privacy controls of the site.