CVE-2025-11072
CVE-2025-11072
Medium · published November 5, 2025
What it is
The MelAbu WP Download Counter Button WordPress plugin through 1.8.6.7 does not validate the path of files to be downloaded, which could allow unauthenticated attacker to read/download arbitrary files.
The record
Technical detail
- CVSS v3.1
- 5.3 · MEDIUM
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- CVSS v4.0
- Not supplied
- EPSS
- 0.00349 · 27.3th percentile
- Published
- 2025-11-05T11:15Z
References (1)
EPSS history
Timeline