The Simple Download Counter plugin for WordPress contains an arbitrary file read flaw in the simple_download_counter_download_handler routine. Attackers who possess Author level access or higher can request a file path and read any local file on the server, including sensitive configuration files such as wp-config.php or system files like /etc/passwd. This flaw exposes confidential data.

The vulnerability affects the specialk Simple Download Counter WordPress plugin in all releases up to and including version 2.0. Users running any earlier release of this plugin are at risk; newer versions after 2.0 are not known to be affected.

The flaw has a CVSS score of 6.5, indicating moderate severity. The EPSS score is less than 1%, implying a low likelihood of widespread exploitation, and it is not listed in the CISA KEV catalog. The likely attack vector is an authenticated web request routed to the download handler, which requires Author or higher privileges. Once authenticated, the attacker can supply a file path parameter to read arbitrary files on the server.