WordPress Contact Forms by Cimatti Missing Authorization Vulnerability in File Download Function

A vulnerability exists in the WordPress Contact Forms by Cimatti plugin, affecting all versions through 1.9.4. The issue arises from a missing capability check in the 'accua_forms_download_submitted_file()' function, allowing unauthenticated users to download files submitted by other users via the contact forms.

Impact

Exploitation of this vulnerability allows for unauthorized access to user-submitted files, potentially leading to privacy violations or data leaks.

Reproduction

To reproduce this vulnerability, send a request to 'admin-ajax.php' with the action 'accua_forms_download_submitted_file', along with the 'subid', 'field', and 'file' parameters. The request can be made without authentication, bypassing any user permission checks.

Remediation

Users are advised to update the WordPress Contact Forms by Cimatti plugin to version 1.9.5 or later.