WordPress Sandbox Plugin Missing Authorization Vulnerability in Export Download Action

A vulnerability exists in the Sandbox plugin for WordPress, all versions through 0.4, due to a lack of proper capability checks on the export_download action. This flaw allows authenticated users with Subscriber-level access and higher to download a complete copy of a sandbox environment, which may include sensitive information such as the wp-config.php file.

Impact

Exploitation of this vulnerability could lead to unauthorized access to sensitive information contained within a user's sandbox environment, including the wp-config.php file.