5.3
Medium
CVE-2025-11072 The MelAbu WP Download Counter Button WordPress plugin through 1.8.6.7 does not validate the path of files to be…
Description
The MelAbu WP Download Counter Button WordPress plugin through 1.8.6.7 does not validate the path of files to be downloaded, which could allow unauthenticated attacker to read/download arbitrary files.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| MelAbu WP Download Counter Button 1.8 | earliest → 1.8.6.7 | No fix stated |