The vulnerability in the MelAbu WP Download Counter Button plugin allows an attacker with no authentication to request arbitrary files from the server. The plugin fails to validate the file path supplied in the download request, which effectively turns it into a path traversal flaw. An attacker could read sensitive configuration files, source code or other private data that resides on the same web root, compromising confidentiality.

WordPress sites running the MelAbu WP Download Counter Button plugin version 1.8.6.7 or earlier are affected. No other vendors or product versions were identified in the CNA report.

The CVSS score of 5.3 indicates a moderate impact. The EPSS score of less than 1% points to a low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. Nevertheless, because the flaw permits unauthenticated reading of arbitrary files via a web request, it is best addressed through a patch or the stated workaround. The likely attack vector is a web-based HTTP request targeting the plugin’s download endpoint.