CVE-2025-11072 — Download Counter Button <= 1.8.6.7 - Unauthenticated Arbitrary File Download

CVE-2025-11072

Download Counter Button <= 1.8.6.7 - Unauthenticated Arbitrary File Download PUBLISHED

Description (CNA)

The MelAbu WP Download Counter Button WordPress plugin through 1.8.6.7 does not validate the path of files to be downloaded, which could allow unauthenticated attacker to read/download arbitrary files.

Affected (CNA)

Vendor / product	Versions
Unknown / MelAbu WP Download Counter Button	affected 0 through 1.8.6.7

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/538117c5-b04c-45fc-a953-6f619fdf7eaf/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.