This vulnerability is an improper verification of the source of a communication channel that enables exploitation of trusted credentials. An attacker can bypass the normal access controls in the WordPress Sell Downloads plugin and act with the privileges of an authenticated user, potentially downloading restricted files or altering plugin settings. The weakness is classified as CWE‑940.

The vulnerability affects the CodePeople2 Sell Downloads plugin for WordPress, specifically all releases up to and including version 1.2.3. Any installation of a version labeled "n/a" through 1.2.3 is impacted.

The CVSS score is 6.5, indicating medium severity. The EPSS score is not available and the vulnerability is not listed in CISA’s KEV catalog, so the overall exploitation probability cannot be precisely quantified. The likely attack vector is via the web interface of a WordPress site that has the plugin installed, where an attacker who controls authenticated credentials can target the plugin’s API endpoints. No additional conditions are stated, so the vulnerability can be exploited by an attacker who can reach the plugin’s functionality from a web browser.