CVE-2025-11072: Arbitrary File Access in MelAbu WP Download Counter Button

The primary impact of this vulnerability is the unauthorized disclosure of sensitive files. An attacker could leverage this to access configuration files, database backups, or even source code, depending on the server's file system permissions. Successful exploitation could lead to data breaches, compromise of server credentials, and potential escalation of privileges. While the vulnerability requires no authentication, the attacker must be able to interact with the plugin's download functionality to trigger the file access. The potential blast radius is significant, particularly if the server hosts sensitive data or is part of a larger network.

1. Reserved2025-09-26
2. Published2025-11-05
3. Modified2026-04-02
4. EPSS updated2026-03-23

The immediate mitigation is to upgrade the MelAbu WP Download Counter Button plugin to a version containing the security fix, once released by the vendor. In the interim, consider disabling the plugin entirely to prevent exploitation. As a temporary workaround, restrict file system permissions to prevent the plugin from accessing sensitive directories. Implement a Web Application Firewall (WAF) with rules to block requests attempting to access files outside of the intended download directory. Monitor WordPress logs for suspicious file access attempts.