aoa-downloadable WordPress Plugin Unauthenticated Server-Side Request Forgery Vulnerability

A server-side request forgery (SSRF) vulnerability has been identified in the aoa-downloadable WordPress plugin, affecting versions through 0.1.0. The vulnerability arises from a lack of authorization and authentication for requests made to the download.php endpoint, allowing unauthenticated users to send requests to arbitrary URLs.

Impact

Exploitation of this vulnerability allows for unauthenticated server-side request forgery, where an attacker can make the server send requests to internal or external resources, potentially leading to the exposure of sensitive information or interaction with internal services.