WordPress Download Attachments Plugin Authorization Bypass Vulnerability Allowing Insecure Direct Object References

A vulnerability allowing authorization bypass through user-controlled keys has been identified in the WordPress Download Attachments plugin, specifically in versions through 1.4.0. This issue arises from incorrectly configured access control security levels, leading to insecure direct object references (IDOR).

Impact

Exploitation of this vulnerability could allow unauthorized users to access restricted objects or files, bypassing normal authorization checks.

Remediation

Users are advised to update the Download Attachments plugin to the latest version. If unable to do so, consult with your hosting provider or web developer for assistance.