F70 Lead Document Download <= 1.4.4 - Missing Authorization to Unauthenticated Arbitrary Media File Download
mediumThe F70 Lead Document Download plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'file_download' function in all versions up to, and including, 1.4.4. This makes it possible for unauthenticated attackers to download any file from the WordPress media library by gu...
- CVSS:
- 5.3
- Affected:
- up to 1.4.4
- Fix:
- No patched version reported
- Disclosed:
- Dec 19, 2025