The 2Download Connector for 2DL Hosted Checkout plugin for WordPress contains an authorization flaw (CWE-862). The plugin fails to verify that a user is permitted to request customer subscription information. Consequently, any unauthenticated web request—including the use of the 'ToDownload_email' parameter—can expose private subscription details such as status, product names, order IDs, purchase dates, and expiry dates. The vulnerability compromises confidentiality by allowing the disclosure of sensitive data to outsiders. The scope is limited to systems that host the affected plugin, but once the plugin is activated on a site, the exposed data is available to all network traffic that can reach the site.

All instances of the 2Download Connector for 2DL Hosted Checkout through version 0.1.5 are affected. The vulnerability exists in every WordPress site that has installed this plugin version or an older one. No other product versions or vendors are listed as impacted.

The CVSS score of 5.3 classifies this issue as medium severity. There is no EPSS score available, and the vulnerability is not listed in the CISA KEV catalog, indicating it is not a known exploited vulnerability. The attack vector is likely through a web request that manipulates the 'ToDownload_email' parameter; no authentication is required. While the exploitation is straightforward, the impact is limited to data exposure rather than system compromise, which reduces the overall risk relative to high‑severity vulnerabilities.