5.4 Medium

CVE-2021-25059 The Download Plugin WordPress plugin before 2.0.0 does not properly validate a user has the required privileges to…

Description

The Download Plugin WordPress plugin before 2.0.0 does not properly validate a user has the required privileges to access a backup's nonce identifier, which may allow any users with an account on the site (such as subscriber) to download a full copy of the website.

Affected products and versions

Product	Affected versions	Fixed in
Download Plugin 2.0	earliest → < 2.0.0	2.0.0

The 2 CVEs of Download Plugin →

CVE-2021-24703 The Download Plugin WordPress plugin before 1.6.1 does not have capability and CSRF checks in the… Not rated

Do you use Download Plugin?

Track this CVE Watch Download Plugin Check my SBOMs

www.cveye.io/en/cve/CVE-2021-25059

Timeline

Published November 28, 2022
Last modified April 25, 2025

References

wpscan.com wpscan.com

Track this CVE

CVE-2021-25059 The Download Plugin WordPress plugin before 2.0.0 does not properly validate a user has the required privileges to…

Description

Affected products and versions

Other CVEs of Download Plugin