CVE-2014-5465: Werdswords Download Shortcode

Medium severity, CVSS 5.0. EPSS: 13.5% chance of exploitation in the next 30 days.

Directory traversal vulnerability in force-download.php in the Download Shortcode plugin 0.2.3 and earlier for WordPress allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter.

Affected products

• Werdswords Download Shortcode: up to and including 0.2.3; version 0.1 only; version 0.2 only; version 0.2.2 only

Published 2014-09-03. Last modified 2026-06-17.