CVE-2005-10002

MEDIUM

almosteffortless secure-files <1.1 - Path Traversal

Title source: llm

Description

A vulnerability, which was classified as critical, was found in almosteffortless secure-files Plugin up to 1.1 on WordPress. Affected is the function sf_downloads of the file secure-files.php. The manipulation of the argument downloadfile leads to path traversal. Upgrading to version 1.2 is able to address this issue. The name of the patch is cab025e5fc2bcdad8032d833ebc38e6bd2a13c92. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-243804.

References (3)

Core 3

Core References

Third Party Advisory vdb-entry technical-description

https://vuldb.com/?id.243804

Permissions Required, Third Party Advisory signature permissions-required

https://vuldb.com/?ctiid.243804

Patch patch

https://github.com/wp-plugins/secure-files/commit/cab025e5fc2bcdad8032d833ebc38e6bd2a13c92

Scores

CVSS v3 5.5

EPSS 0.0075

EPSS Percentile 50.3%

Attack Vector ADJACENT_NETWORK

CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Details

CWE

CWE-22

Status published

Products (1)

wp-plugins/secure_files < 1.2

Published Oct 29, 2023

Tracked Since Feb 18, 2026