The vulnerability resides in the mkscripts Download After Email WordPress plugin version 2.1.9 and earlier, where the plugin fails to enforce proper authorization checks. As a result, authenticated and unauthenticated users can request and obtain downloadable content without restriction, effectively bypassing the intended access control policy. This flaw can expose confidential files or proprietary material that should otherwise be protected by user permissions or download limits, adversely affecting confidentiality and potentially leading to further exploitation within the site.

The affected system is the WordPress plugin Download After Email released by mkscripts. Versions from the earliest release through 2.1.9 are impacted. Users who have not upgraded beyond 2.1.9 are therefore exposed.

The CVSS score of 5.3 indicates a medium severity that includes potential for unauthorized data disclosure. The EPSS score is less than 1%, showing a very low likelihood of exploitation at any given moment. This vulnerability is not listed in the CISA KEV catalog, suggesting limited public exploitation. It is inferred that the attack path involves an HTTP request to the plugin’s download endpoint, which does not verify user identity or role. While the lower EPSS lowers immediate risk, the presence of missing authorization warrants monitoring and timely remediation.