Description
The MelAbu WP Download Counter Button WordPress plugin through 1.8.6.7 does not validate the path of files to be downloaded, which could allow unauthenticated attacker to read/download arbitrary files.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | MelAbu WP Download Counter Button | ≤ 1.8.6.7 | — |
References
- https://wpscan.com/vulnerability/538117c5-b04c-45fc-a953-6f619fdf7eaf/ exploit vdb-entry technical-description