CVE-2026-39616
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk12th percentile - higher than 12% of all known CVEs
Summary
The Download Attachments plugin for WordPress has an authorization bypass vulnerability through a user-controlled key, allowing exploitation of incorrectly configured access control security levels. This issue affects versions up to and including 1.4.0.
Risk Assessment
An attacker can access protected attachments or data, compromising confidentiality and potentially leading to leakage of sensitive information.
Recommendation
Update the Download Attachments plugin to a version that includes a fix for this vulnerability.
Original NVD description (English source)
Authorization Bypass Through User-Controlled Key vulnerability in dFactory Download Attachments download-attachments allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Download Attachments: from n/a through <= 1.4.0.