Description
WordPress Plugin Filedownload is prone to a local file disclosure vulnerability because it fails to adequately validate user-supplied input. Exploiting this vulnerability could allow an attacker to obtain potentially sensitive information from local files on computers running the vulnerable application; this may aid in further attacks. WordPress Plugin Filedownload version 0.1 is vulnerable.
Remediation
Update to plugin version 0.2 or latest
References
http://www.securityfocus.com/bid/49669/exploit
http://www.exploit-db.com/exploits/17858/
http://packetstormsecurity.com/files/view/105215/wpfiledownload-disclose.txt
Related Vulnerabilities
WordPress 4.0.x Multiple Vulnerabilities (4.0 - 4.0.24)
Joomla Improper Authentication Vulnerability (CVE-2014-6632)
WordPress Plugin Relevanssi-A Better Search Cross-Site Scripting (3.5.7.1)
SharePoint CVE-2023-36764 Vulnerability (CVE-2023-36764)
WordPress Plugin Tera Charts Multiple Local File Inclusion Vulnerabilities (0.1)