CVE-2025-1730CWE-73

Simple Download Counter <= 2.0 - Authenticated (Author+) Arbitrary File Read

Medium · published March 1, 2025

CVSS v3.1
6.5
EPSS
0%
Percentile
37.5
In the wild
Unconfirmed
What it is

The Simple Download Counter plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 2.0 via the 'simple_download_counter_download_handler'. This makes it possible for authenticated attackers, with Author-level access and above, to extract sensitive data including any local file on the server, such as wp-config.php or /etc/passwd.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00443 · 37.5th percentile
Weakness
CWE-73 · External Control of File Name or Path
Published
2025-03-01T06:39Z
EPSS history
Timeline
  • 01 MAR 06:39Z
    Simple Download Counter <= 2.0 - Authenticated (Author+) Arbitrary File Read
    cvelistv5