CVE-2025-11072

Full vulnerability record from the local CVENow database.

Description

The MelAbu WP Download Counter Button WordPress plugin through 1.8.6.7 does not validate the path of files to be downloaded, which could allow unauthenticated attacker to read/download arbitrary files.

Severity

MEDIUM

CVSS score

5.3 (v3.1)

Vulnerability status

Deferred

Source identifier

[email protected]

Published

2025-11-05 06:15:32.990000

Last modified

2026-10-19 13:10:00.110000

View original CVE JSON

{
  "id": "CVE-2025-11072",
  "sourceIdentifier": "[email protected]",
  "published": "2025-11-05T06:15:32.990",
  "lastModified": "2026-10-19T13:10:00.110",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "The MelAbu WP Download Counter Button WordPress plugin through 1.8.6.7 does not validate the path of files to be downloaded, which could allow unauthenticated attacker to read/download arbitrary files."
    },
    {
      "lang": "es",
      "value": "El plugin de WordPress MelAbu WP Download Counter Button hasta la versión 1.8.6.7 no valida la ruta de los archivos a descargar, lo que podría permitir a un atacante no autenticado leer/descargar archivos arbitrarios."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "Unknown",
          "product": "MelAbu WP Download Counter Button",
          "defaultStatus": "unknown",
          "versions": [
            {
              "version": "0",
              "lessThanOrEqual": "1.8.6.7",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
          "baseScore": 5.3,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "LOW",
          "integrityImpact": "NONE",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 1.4
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2025-11-05T18:36:27.812038Z",
          "id": "CVE-2025-11072",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "references": [
    {
      "url": "https://wpscan.com/vulnerability/538117c5-b04c-45fc-a953-6f619fdf7eaf/",
      "source": "[email protected]"
    }
  ]
}