CVE-2025-11072: Unknown Melabu Wp Download Counter Button

Medium severity, CVSS 5.3. EPSS: 0.3% chance of exploitation in the next 30 days.

The MelAbu WP Download Counter Button WordPress plugin through 1.8.6.7 does not validate the path of files to be downloaded, which could allow unauthenticated attacker to read/download arbitrary files.

Affected products

• Unknown Melabu Wp Download Counter Button: up to and including 1.8.6.7

Published 2025-11-05. Last modified 2026-06-17.