What is the CVSS score of CVE-2025-54743?

CVE-2025-54743 has a CVSS 3.1 base score of 5.8 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N. EPSS exploitation probability: 0.1%.

Download After Email CVE-2025-54743

MEDIUM

Missing Authorization (CWE-862)

2025-12-18 audit@patchstack.com

WordPress Authentication Bypass Wordpress Plugin

5.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.8 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N

vuln.today AI

5.8 MEDIUM

Remote attack with no auth; low confidentiality impact only.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 26, 2026 - 17:00 vuln.today

DescriptionCVE.org

Missing Authorization vulnerability in mkscripts Download After Email download-after-email allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Download After Email: from n/a through 2.1.5-2.1.6.

AnalysisAI

Missing authorization in the Download After Email WordPress plugin versions 2.1.5 through 2.1.6 allows unauthenticated attackers to bypass access controls and access protected downloads intended for users who submit their email. The vulnerability has a CVSS base score of 5.8 (medium) but EPSS exploitation probability is very low (0.08%), and no public exploit or active exploitation has been reported.

Technical ContextAI

The vulnerability is a CWE-862 Missing Authorization, meaning the plugin fails to properly verify access rights for certain endpoints. The Download After Email plugin is designed to gate file downloads behind an email submission form. The missing authorization likely allows direct access to download URLs without the required email submission, exposing files that should be protected. The CVSS vector indicates a network attack vector with low complexity, no privileges, and no user interaction, with a scope change affecting other resources (the protected downloads), but only low confidentiality impact.

Affected ProductsAI

The vulnerability affects the Download After Email WordPress plugin version 2.1.5 and 2.1.6 (versions from n/a through 2.1.5-2.1.6 according to the advisory). The plugin is available from the WordPress plugin repository. The reference advisory is from Patchstack: https://patchstack.com/database/Wordpress/Plugin/download-after-email/vulnerability/wordpress-download-after-email-plugin-2-1-5-2-1-6-other-vulnerability-type-vulnerability

RemediationAI

No vendor-released patch has been identified in the provided data. The affected versions are 2.1.5 and 2.1.6; users should update to a patched version if and when the plugin author releases one. As a temporary workaround, restrict access to the plugin's download endpoints using web application firewall rules (e.g., Wordfence) or .htaccess directives to block direct requests to download.php or similar files without a valid session. Alternatively, disable the plugin until a secure version is available. Note that these mitigations may break legitimate functionality for users who submit their email.