The vulnerability originates from a missing authorization check within the Shahjada Download Manager plugin, allowing an attacker to access files that should be restricted. This flaw permits unauthorized download of protected content, compromising the confidentiality of data held on the WordPress site. The impact is limited to file access; the attacker cannot modify the site or execute arbitrary code, but can retrieve information not intended for public consumption.

The affected product is the Shahjada Download Manager plugin for WordPress, versions up through 3.3.52. Site administrators using these versions should verify their plugin version and elevation of privileges is not impacted.

With a CVSS score of 5.3, the vulnerability presents a moderate severity risk. The EPSS score is below 1%, indicating a low probability of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. An attacker can reach the affected functionality via the web interface of the WordPress site, typically by crafting a URL to a protected file without needing prior authentication. As such, the recommended approach is to apply the vendor patch promptly; at present there is no official workaround.