CVE-2025-11072
Download Counter Button <= 1.8.6.7 - Unauthenticated Arbitrary File Download
Vexday Risk Score
13Low
SSVC decision (CISA)
Track
No exploitation signal → monitor
CVSS 5.3EPSS 0.3%KEV nãoPoC —Nuclei —Metasploit —Patch —
Lifecycle
05 Nov 2025Published on NVD
Recommendation: Monitor — no exploitation signal at the moment.
The MelAbu WP Download Counter Button WordPress plugin through 1.8.6.7 does not validate the path of files to be downloaded, which could allow unauthenticated attacker to read/download arbitrary files.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Affected products
Unknown · MelAbu WP Download Counter Button