WordPress Plugin Vulnerabilities

Files Download Delay < 1.0.7 - Subscriber+ Settings Reset

Description

The plugin does not have authorisation and CSRF checks when reseting its settings, which could allow any authenticated users, such as subscriber to perform such action.

Proof of Concept

Affects Plugins

Plugin icon
files-download-delay
Fixed in 1.0.7

References

CVE
CVE-2022-1570

Classification

Type
NO AUTHORISATION
OWASP top 10
A5: Broken Access Control
CWE
CWE-862
CVSS
5.4 (medium)

Miscellaneous

Original Researcher
Daniel Ruf
Submitter
Daniel Ruf
Submitter website
https://daniel-ruf.de
Verified
Yes
WPVDB ID
c0257564-48ee-4d02-865f-82c8b5e793c9

Timeline

Publicly Published
2022-05-13 (about 3 years ago)
Added
2022-05-13 (about 3 years ago)
Last Updated
2022-05-15 (about 3 years ago)

Other

Published
Title
Published
2025-06-05
Title
TicketBAI Facturas para WooCommerce <= 3.36 - Missing Authorization
Published
2024-12-23
Title
PlugVersions – Easily rollback to previous versions of your plugins < 0.0.8 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Creation
Published
2024-07-19
Title
Security Optimizer – The All-In-One Protection Plugin < 1.5.1 - Missing Authorization via hide_notice()
Published
2025-04-01
Title
Ship Per Product <= 2.1.0 - Missing Authorization
Published
2024-08-12
Title
Bit Form Pro < 2.8.0 - Missing Authorization to Authenticated (Subscriber+) Settings Update