Beta

Report

m1.DownloadList <= 0.23 is vulnerable to Sensitive Data Exposure vulnerability

Contributor
Published
2025-04-03

The m1.DownloadList plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 0.23. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract sensitive user or configuration data.

CVE

https://www.cve.org/CVERecord?id=CVE-2025-32164

CVSS

Score:6.5

Severity:Medium

Version: 0.23

The plugin vendor has not patched this vulnerability at the moment.