Wp File Download
Monthly
Unauthenticated cross-site scripting (XSS) in the WP File Download WordPress plugin (versions up to and including 6.3.6) allows remote attackers to inject malicious scripts into a victim's browser session, potentially leading to session hijacking, data theft, or site defacement, though meaningful impact requires luring a privileged user. The flaw requires user interaction (e.g., clicking a crafted link) and affects any WordPress site using this JoomUnited plugin; no public exploit code has been identified at time of analysis, and the CVSS score is 7.1 (moderate severity).
Authorization bypass in the JoomUnited WP File Download plugin for WordPress (all versions up to and including 6.3.9) allows any authenticated user with subscriber-level access or above to permanently delete any file managed by the plugin, empty the entire trash, move files between categories, and publish or unpublish arbitrary files. The flaw is a missing authorization check (CWE-862), meaning the plugin's action handlers never verify that the caller holds a capability appropriate for the requested operation, so the lowest-privilege WordPress role is sufficient. No public exploit code was identified at time of analysis and the CVE is not listed in CISA KEV, but the barrier to exploitation is low because subscriber accounts are frequently obtainable through open self-registration; the assessed CVSS 3.1 base score is 8.1 (High) with high integrity and availability impact and no confidentiality impact.
Arbitrary file deletion in the WP File Download WordPress plugin (all versions, by JoomUnited) allows any authenticated subscriber-level user to delete files outside the plugin's intended directory, with trivial escalation to remote code execution by targeting wp-config.php. The vulnerability stems from two AJAX endpoints - file.save and file.delete - that lack both WordPress capability checks and nonce enforcement, permitting the two-stage exploit chain against any authenticated session. No public exploit code has been confirmed at time of analysis, but the Wordfence advisory describes the precise two-request mechanism in sufficient detail to enable rapid weaponization.
Directory traversal in JoomUnited's WP File Download WordPress plugin (all versions through 6.3.8) enables server-side file disclosure via a two-stage attack chain. A subscriber-level authenticated attacker first poisons a post-meta value through an unprotected file.save handler, after which the plugin's streaming endpoint — registered on WordPress's init hook with no authentication check — resolves and serves the traversed file path to any HTTP caller, including fully unauthenticated visitors. No public exploit code or CISA KEV listing has been identified at time of analysis, but Wordfence has published the vulnerability details and a trac browser link pointing directly to the vulnerable code at app/site/init.php line 225.
CVE-2025-5034 is a Reflected Cross-Site Scripting (XSS) vulnerability in the wp-file-download WordPress plugin versions before 6.2.6, caused by failure to sanitize and escape user-supplied parameters before output. Attackers can craft malicious URLs containing JavaScript payloads that execute in victims' browsers when clicked, potentially stealing session cookies, hijacking accounts, or performing unauthorized actions. The vulnerability requires user interaction (clicking a link) but affects all users without authentication requirements, making it a moderate-to-significant risk for WordPress installations using this plugin.
Unauthenticated cross-site scripting (XSS) in the WP File Download WordPress plugin (versions up to and including 6.3.6) allows remote attackers to inject malicious scripts into a victim's browser session, potentially leading to session hijacking, data theft, or site defacement, though meaningful impact requires luring a privileged user. The flaw requires user interaction (e.g., clicking a crafted link) and affects any WordPress site using this JoomUnited plugin; no public exploit code has been identified at time of analysis, and the CVSS score is 7.1 (moderate severity).
Authorization bypass in the JoomUnited WP File Download plugin for WordPress (all versions up to and including 6.3.9) allows any authenticated user with subscriber-level access or above to permanently delete any file managed by the plugin, empty the entire trash, move files between categories, and publish or unpublish arbitrary files. The flaw is a missing authorization check (CWE-862), meaning the plugin's action handlers never verify that the caller holds a capability appropriate for the requested operation, so the lowest-privilege WordPress role is sufficient. No public exploit code was identified at time of analysis and the CVE is not listed in CISA KEV, but the barrier to exploitation is low because subscriber accounts are frequently obtainable through open self-registration; the assessed CVSS 3.1 base score is 8.1 (High) with high integrity and availability impact and no confidentiality impact.
Arbitrary file deletion in the WP File Download WordPress plugin (all versions, by JoomUnited) allows any authenticated subscriber-level user to delete files outside the plugin's intended directory, with trivial escalation to remote code execution by targeting wp-config.php. The vulnerability stems from two AJAX endpoints - file.save and file.delete - that lack both WordPress capability checks and nonce enforcement, permitting the two-stage exploit chain against any authenticated session. No public exploit code has been confirmed at time of analysis, but the Wordfence advisory describes the precise two-request mechanism in sufficient detail to enable rapid weaponization.
Directory traversal in JoomUnited's WP File Download WordPress plugin (all versions through 6.3.8) enables server-side file disclosure via a two-stage attack chain. A subscriber-level authenticated attacker first poisons a post-meta value through an unprotected file.save handler, after which the plugin's streaming endpoint — registered on WordPress's init hook with no authentication check — resolves and serves the traversed file path to any HTTP caller, including fully unauthenticated visitors. No public exploit code or CISA KEV listing has been identified at time of analysis, but Wordfence has published the vulnerability details and a trac browser link pointing directly to the vulnerable code at app/site/init.php line 225.
CVE-2025-5034 is a Reflected Cross-Site Scripting (XSS) vulnerability in the wp-file-download WordPress plugin versions before 6.2.6, caused by failure to sanitize and escape user-supplied parameters before output. Attackers can craft malicious URLs containing JavaScript payloads that execute in victims' browsers when clicked, potentially stealing session cookies, hijacking accounts, or performing unauthorized actions. The vulnerability requires user interaction (clicking a link) but affects all users without authentication requirements, making it a moderate-to-significant risk for WordPress installations using this plugin.