CVE-2025-11072
Medium · 5.3CVSS
5.3
EPSS
0.3%
Published
Nov 5, 2025
CISA due date
—
The record
The MelAbu WP Download Counter Button WordPress plugin through 1.8.6.7 does not validate the path of files to be downloaded, which could allow unauthenticated attacker to read/download arbitrary files.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|