CVE-2025-11072

Download Counter Button <= 1.8.6.7 - Unauthenticated Arbitrary File Download

The MelAbu WP Download Counter Button WordPress plugin through 1.8.6.7 does not validate the path of files to be downloaded, which could allow unauthenticated attacker to read/download arbitrary files.

Affected

MelAbu WP Download Counter Button

CVSS v3.1 CNA

5.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

EPSS

0.35% chance of exploitation in the next 30 days, 27th percentile

Published

2025-11-05

Updated

2026-04-02

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/538117c5-b04c-45fc-a953-6f619fdf7eaf/

References

• CVE Record
• NVD entry