The Download Plugins and Themes in ZIP from Dashboard plugin for WordPress is vulnerable to Cross‑Site Request Forgery due to missing or incorrect nonce validation on the download_plugin_bulk and download_theme_bulk functions. A forged request can cause an attacker to trigger the bulk download of all installed plugins and themes, resulting in the archive files being written to the wp‑content/uploads/ directory. This exposes site code and related files to an unauthenticated attacker, which could facilitate further exploitation or data exfiltration.

WordPress sites running the wpcodefactory Download Plugins and Themes in ZIP from Dashboard plugin version 1.9.6 or earlier. Any site that has this plugin installed and is able to process admin‑level requests is susceptible. Update to a version newer than 1.9.6 to address the missing nonce validation.

The CVSS score of 4.3 indicates medium severity, while the EPSS score of less than 1% suggests a low probability of exploitation at present. The vulnerability is not listed in CISA KEV. Attackers would need to trick an administrator into clicking a malicious link or submitting a forged form, so a social‑engineering vector is likely. Post‑exploitation, the attacker could read the archived files and potentially identify additional weaknesses.