Download Media <= 1.4.2 - Missing Authorization via generate_link_for_media
mediumThe Download Media plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'generate_link_for_media' function in versions up to, and including, 1.4.2. This makes it possible for authenticated attackers, with subscriber-level access and above, to generate media download...
- CVSS:
- 4.3
- Affected:
- up to 1.4.2
- Fix:
- No patched version reported
- Disclosed:
- Feb 26, 2024