Aly Khaled

**Name of the Vulnerable Software and Affected Versions** The-wound WordPress theme version 0.0.1 **Description** The issue concerns the failure to validate certain parameters before using them to generate paths passed to include functions, allowing unauthenticated users to perform Local File Inclusion (LFI) attacks and download arbitrary files from the server. This enables attackers to access sensitive information on the server. **Recommendations** For The-wound WordPress theme version 0.0.1, consider updating to a newer version that addresses this issue, as the current version does not validate parameters properly, leading to LFI vulnerabilities. If an update is not available, as a temporary workaround, consider restricting access to include functions or validating parameters manually to prevent LFI attacks. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Nome do Software Vulnerável e Versões Afetadas** Plugin WordPress aoa-downloadable versão 0.1.0 **Descrição** A vulnerabilidade permite que atacantes não autenticados baixem arquivos arbitrários do servidor devido à falta de validação de um parâmetro na função de download. **Recomendações** Para a versão 0.1.0, considere desativar a função de download até que uma correção esteja disponível para prevenir a exploração. Restrinja o acesso a arquivos sensíveis no servidor para minimizar o risco de acesso não autorizado.

**Name of the Vulnerable Software and Affected Versions** aoa-downloadable WordPress plugin versions 0.1.0 and earlier **Description** The issue concerns a lack of authorization and authentication for requests to the "download.php" endpoint, allowing unauthenticated visitors to make requests to arbitrary URLs. **Recommendations** For versions 0.1.0 and earlier, consider disabling access to the "download.php" endpoint until a patch is available. Restrict access to this endpoint to minimize the risk of exploitation. Avoid using this endpoint in unauthenticated contexts until the issue is resolved.