Secure Downloads WordPress Plugin Arbitrary File Download Vulnerability

A vulnerability in the Secure Downloads WordPress plugin, affecting versions prior to 1.2.3, allows authenticated attackers with admin-level access to download arbitrary files. This flaw arises because the plugin does not properly restrict file downloads, potentially exposing sensitive information such as the wp-config.php file.

Impact

Exploitation of this vulnerability could lead to unauthorized access to sensitive files, including configuration files that may contain critical information about the WordPress installation.