Simple Download Counter CVE-2025-13677

Requires an authenticated WordPress user with Administrator-level privileges or above (PR:H) who can reach the plugin's simple_download_counter_parse_path() path-handling functionality; exploitation is network-reachable (AV:N) with no user interaction. Key limiting factors: the attacker must already hold full admin rights, and the vendor has disabled the arbitrary-file-download behavior on WordPress multisite installations - so multisite deployments are not affected, while single-site installs running version ≤2.2.2 (and later versions that retain the behavior by design) remain exploitable. Impact is limited to reading arbitrary server files (confidentiality only); no write/modify or availability impact.

The provided CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N, base 4.9) and the description agree: this is a network-reachable but high-privilege path traversal requiring Administrator-level WordPress access, yielding confidentiality-only impact (arbitrary file read, no integrity or availability loss). The signals are internally consistent - there is no network-vs-local conflict. EPSS is 0.52% (43rd percentile), i.e. low predicted exploitation probability, which fits a flaw gated behind full admin access. The CVE is NOT listed in CISA KEV and no public exploit code is referenced, so there is no evidence of active exploitation. The practical risk ceiling is low: an attacker who already holds Administrator rights on a WordPress site can typically read or exfiltrate most of the same data through legitimate admin functionality, so the marginal escalation here is modest (though reading out-of-webroot files like /etc/passwd or credentials outside the DB is a genuine, if narrow, gain). Notably the vendor did NOT fully remediate - arbitrary remote file download from the server remains allowed by design, with the function only disabled on multisite and a readme.txt warning added - so single-site installations on version 2.2.2 and the forthcoming 'patched' releases may remain behaviorally vulnerable. This is a real but low-priority issue: medium severity on paper, lower real-world urgency given the PR:H gate and absence of KEV/POC signals.

An attacker who has already obtained or compromised a WordPress Administrator account on a single-site install supplies a crafted path to the plugin's download-path handler, causing simple_download_counter_parse_path() to resolve outside the intended directory. They then retrieve wp-config.php to harvest database credentials and secret keys, or read other sensitive system files on the server. No public exploit code is referenced, and the attack requires valid admin authentication.