The vulnerability is a missing authorization flaw that allows an attacker to exploit incorrectly configured access controls within the WordPress "Download After Email" plugin. This weakness, classified as CWE-862, can enable the attacker to obtain data or functions intended to be restricted, potentially exposing confidential files or facilitating further attacks. The vulnerability is not a code‑execution flaw but creates a significant risk of information disclosure.

The issue affects the WordPress "Download After Email" plugin distributed by mkscripts. All released versions from the earliest available build up through 2.1.5-2.1.6 are impacted.

The CVSS score of 5.8 indicates medium severity, and the EPSS score of less than 1% suggests that exploitation probability is currently very low. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that an attacker could exploit the vulnerability via unauthenticated HTTP requests to plugin-controlled endpoints if the access‑control configuration is not correctly enforced, allowing the attacker to read or download protected data.