SocialV WordPress Theme Missing Authorization Vulnerability Allowing Arbitrary File Download

A vulnerability exists in the SocialV - Social Network and Community BuddyPress Theme for WordPress, in all versions through 2.0.15. The issue arises from a missing capability check in the 'socialv_send_download_file' function, which allows authenticated attackers with Subscriber-level access or higher to download arbitrary files from the server.

Impact

Exploitation of this vulnerability could lead to unauthorized access to sensitive files on the server.

Remediation

Users are advised to update the theme to version 2.0.16 or a newer patched version.