Sell Downloads Vulnerabilities

The Sell Downloads plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 1.1.12. This makes it possible for unauthenticated attackers to perform an unauthorized action.

CVSS:

5.3

Affected:

up to 1.1.12

Fixed in:

1.2.0

Disclosed:

Dec 30, 2025

CVE-2025-68850 on NVD →

The sell-downloads plugin before 1.0.8 for WordPress has insufficient restrictions on brute-force guessing of purchase IDs.

CVSS:

7.5

Affected:

up to 1.0.8

Fixed in:

1.0.8

Disclosed:

Jul 10, 2015

CVE-2015-9348 on NVD →

The Sell Downloads plugin for WordPress is vulnerable to Arbitrary File Read in versions up to, and including, 1.0.1 via the 'file' parameter. This can allow unauthenticated attackers to extract sensitive data such as settings/configuration files along with other useful information that can be used in future attacks.

CVSS:

7.5

Affected:

up to 1.0.1

Fixed in:

1.0.2

Disclosed:

Dec 29, 2014

CVE-2014-9511 on NVD →