Download After Email Vulnerabilities

The Download After Email plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 2.1.9. This makes it possible for unauthenticated attackers to perform an unauthorized action.

CVSS:

5.3

Affected:

up to 2.1.9

Fixed in:

2.1.10

Disclosed:

Jan 24, 2026

CVE-2026-24541 on NVD →

The Download After Email – Subscribe & Download Form Plugin plugin for WordPress is vulnerable to unauthorized repeated form submission in versions 2.1.5 to 2.1.6. This is due to the plugin not properly limiting the number of requests a user can make. This makes it possible for unauthenticated attackers to initiate a d...

CVSS:

5.3

Affected:

2.1.5 – 2.1.6

Fixed in:

2.1.7

Disclosed:

Sep 25, 2025

CVE-2025-54743 on NVD →