CVE-2021-25059 — Download Plugin < 2.0.0 - Subscriber+ Website Download
The Download Plugin WordPress plugin before 2.0.0 does not properly validate a user has the required privileges to access a backup's nonce identifier, which may allow any users …
Published: 2022-11-28 · CVSS: 5.4 · CVSS 3.1
The Download Plugin WordPress plugin before 2.0.0 does not properly validate a user has the required privileges to access a backup's nonce identifier, which may allow any users with an account on the site (such as subscriber) to download a full copy of the website.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7