PT-2025-49234

CVE-2025-12876

·

Published

2025-12-04

·

Updated

2026-09-25

Description by

CVSS 3.1
5.3
Medium
MetricsAV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Name of the Vulnerable Software and Affected Versions Projectopia – WordPress Project Management plugin versions up to and including 5.1.19
Description The Projectopia – WordPress Project Management plugin for WordPress has a flaw that allows unauthorized modification of data. Specifically, a missing capability check on the pto delete file AJAX action allows unauthenticated attackers to delete arbitrary attachments.
Recommendations Update Projectopia – WordPress Project Management plugin to a version later than 5.1.19.
Exploitability
Fix
Impacts
Researchers
Vendors
Affected products
Weakness enumeration
CWE-862: Missing Authorization
Related identifiers
CVE-2025-12876
Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com