CVE-2021-25059: Metagauss Download Plugin

Medium severity, CVSS 4.3. EPSS: 0.7% chance of exploitation in the next 30 days.

The Download Plugin WordPress plugin before 2.0.0 does not properly validate a user has the required privileges to access a backup's nonce identifier, which may allow any users with an account on the site (such as subscriber) to download a full copy of the website.

Affected products

• Metagauss Download Plugin: before 2.0.0 (fixed in 2.0.0)

Published 2022-11-28. Last modified 2026-06-17.