The plugin’s file_download function lacks a capability check, allowing any user without authentication to request files from the WordPress media library by guessing attachment IDs. This enables download of arbitrary media files, compromising the confidentiality of stored content.

The vulnerability exists in the WordPress plugin F70 Lead Document Download for all released versions up to and including 1.4.4. Sites running these versions with the plugin active are susceptible if the function can be called externally.

The CVSS score of 5.3 indicates moderate severity, and the EPSS score of less than 1% suggests a low likelihood of exploitation at present. The issue is not listed in the CISA KEV catalog. Attackers can trigger the flaw remotely by directing any visitor to the file download endpoint; the missing check is the prerequisite for successful exploitation.