ERI File Library Missing Authorization Vulnerability Allowing Unauthenticated Protected File Download

A vulnerability exists in the ERI File Library plugin for WordPress, in all versions through 1.1.0. The issue arises from a missing capability check on the 'erifl_file' AJAX action, which allows unauthenticated attackers to download files that are restricted to certain user roles.

Impact

Exploitation of this vulnerability could lead to unauthorized access to protected files, allowing unauthenticated users to download them.

Reproduction

To reproduce this vulnerability, send an AJAX request to the 'erifl_file' action without authentication. Include the file ID of the protected file in the request. The absence of a capability check will allow the download to proceed, bypassing the intended user role restrictions.

Remediation

Users are advised to update the ERI File Library plugin to version 1.1.1 or later.