CVE-2024-8031

6.5 mediumEPSS 0.5%

Medium (6.5) in wpbookingcalendar secure downloads. EPSS 0.5% chance of exploitation in the next 30 days.

The Secure Downloads WordPress plugin before 1.2.3 is vulnerable does not properly restrict which files can be downloaded. This makes it possible for authenticated attackers, with admin-level access and above, to download arbitrary files that may contain sensitive information like wp-config.php.

Severity

CVSS 3.1

6.5 medium

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

EPSS: 0.5% chance of exploitation in the next 30 days; higher than 44% of CVEs (scores of 2026-10-31)
CWE: CWE-552
Published: 2025-05-15
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

wpbookingcalendar:secure_downloads

References

https://wpscan.com/vulnerability/c6f54e6f-0a50-424f-ae3a-00b9880d9f13/

Check your stack JSON