The Media Library File Download plugin through version 1.4 contains a CSRF flaw that lets an attacker craft a request which is executed with the privileges of a logged‑in user. This weakness permits the unauthorized download of media files or other privileged actions and is classified as CWE‑352 due to missing token validation.

WordPress sites that use the Media Library File Download plugin up to and including 1.4 are affected. Site administrators should verify the installed version and apply updates where possible.

The CVSS base score of 4.3 reflects moderate severity, and the EPSS score of less than 1% indicates a low probability of exploitation at present. The flaw is not listed in the CISA KEV catalog. An attacker would need to lure an authenticated user to send a crafted request that bypasses CSRF protection; thus, having an active session or compromised credentials is a prerequisite for exploitation.