Simple Download Counter WordPress Plugin Arbitrary File Read Vulnerability

A vulnerability allowing arbitrary file read has been identified in the Simple Download Counter plugin for WordPress, affecting all versions through 2.0. The issue arises in the 'simple_download_counter_download_handler' function, where authenticated attackers with Author-level access or higher can access sensitive files on the server, such as 'wp-config.php' or '/etc/passwd'.

Impact

Exploitation of this vulnerability allows authenticated users to read arbitrary files on the server, potentially leading to the disclosure of sensitive information.

Reproduction

To reproduce this vulnerability, an authenticated user with Author-level access or higher can use the 'simple_download_counter_download_handler' function to request files from the server. This can be done by specifying the file path in the download handler, which will then be read and returned by the server.

Remediation

Users are advised to update the Simple Download Counter plugin to version 2.1 or later.