WordPress Plugin Vulnerabilities

Media Library Downloader < 1.3.2 - Missing Authorization

Description

The Media Library Downloader plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the mld_download_files() function in all versions up to, and including, 1.3.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to download files.

Affects Plugins

Plugin icon
media-library-downloader
Fixed in 1.3.2

References

CVE
CVE-2025-46519
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/ae9c421c-925b-4c2d-b3f5-781c54a85c2e

Classification

Type
NO AUTHORISATION
OWASP top 10
A5: Broken Access Control
CWE
CWE-862
CVSS
4.3 (medium)

Miscellaneous

Original Researcher
ch4r0n
Verified
No
WPVDB ID
ca393761-cd3a-4285-a358-796bac8393f2

Timeline

Publicly Published
2025-04-24 (about 1 year ago)
Added
2025-04-30 (about 1 year ago)
Last Updated
2025-04-30 (about 1 year ago)

Other

Published
Title
Published
2026-01-29
Title
Echo Knowledge Base – Documentation, FAQs, AI Chat & AI Search < 16.20.0 - Missing Authorization
Published
2026-03-17
Title
The League <= 4.4.1 - Missing Authorization
Published
2024-04-15
Title
WPC Grouped Product for WooCommerce < 4.4.3 - Missing Authorization
Published
2026-04-07
Title
WP Blockade <= 0.9.14 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Shortcode Execution via 'shortcode' Parameter
Published
2023-07-17
Title
ProfileGrid < 5.5.3 - Group Owner+ Unauthorized Data Modification