PT-2025-9160 · WordPress · Simple Download Counter

Emil + 1 · Published 2025-03-01 · Updated 2025-03-02 · CVE-2025-1730

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Simple Download Counter plugin for WordPress versions up to and including 2.0

Description The issue allows authenticated attackers with Author-level access and above to read arbitrary files on the server, including sensitive data such as wp-config.php or /etc/passwd, via the simple download counter download handler.

Recommendations For Simple Download Counter plugin for WordPress versions up to and including 2.0, update to a version above 2.0 to resolve the issue.

Fix

Weakness Enumeration

CWE-73

Related Identifiers

CVE-2025-1730

Affected Products

Simple Download Counter

References · 11

• https://nvd.nist.gov/vuln/detail/CVE-2025-1730 · Security Note
• https://plugins.trac.wordpress.org/browser/simple-download-counter/tags/2.0/inc/functions-core.php#L354 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/d0eafb20-4ef2-448b-9da7-ad8aa9e45215?source=cve · Note
• https://t.me/cvenotify/112973 · Telegram Post
• https://t.me/cvedetector/19224 · Telegram Post
• https://plugins.trac.wordpress.org/changeset/3247987 · Note
• https://plugins.trac.wordpress.org/browser/simple-download-counter/tags/2.0/inc/functions-core.php#L328 · Note
• https://twitter.com/cybercronai/status/1896130995121766527 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1895741388102185387 · Twitter Post
• https://twitter.com/WolfgangSesin/status/1895766927999410453 · Twitter Post
• https://twitter.com/CVEnew/status/1895981996511543429 · Twitter Post