CVE-2024-8031

Secure Downloads < 1.2.3 - Admin+ Arbitrary File Download

Medium · published May 15, 2025

CVSS v3.1
6.5
EPSS
1%
Percentile
44.0
In the wild
Unconfirmed
What it is

The Secure Downloads WordPress plugin before 1.2.3 is vulnerable does not properly restrict which files can be downloaded. This makes it possible for authenticated attackers, with admin-level access and above, to download arbitrary files that may contain sensitive information like wp-config.php.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00530 · 44.0th percentile
Published
2025-05-15T20:07Z
EPSS history
Timeline
  • 15 MAY 20:07Z
    Secure Downloads < 1.2.3 - Admin+ Arbitrary File Download
    cvelistv5