CVE-2024-8031

PoC —

CVSS 3.1

6.5 medium

EPSS

<1%p41

Published

May 15, 2025 (May 15, 2025)

Modified

Jun 17, 2026

Description

The Secure Downloads WordPress plugin before 1.2.3 is vulnerable does not properly restrict which files can be downloaded. This makes it possible for authenticated attackers, with admin-level access and above, to download arbitrary files that may contain sensitive information like wp-config.php.

Vendors: wpbookingcalendar
Products: secure downloads
Ecosystems: WordPress
Weakness: CWE-552
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

NVD CVE.org GitHub PoCs EPSS (0.5%)

In the news0 stories

No ingested article mentions this CVE yet.