Unauthorized File Access in F70 Lead Document Download for WordPress
CVE-2025-14633
5.3MEDIUM
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 20 December 2025
What is CVE-2025-14633?
The F70 Lead Document Download plugin for WordPress contains a vulnerability that allows unauthorized users to access and download files from the WordPress media library. This occurs due to the absence of a necessary capability check in its 'file_download' function. As a result, unauthenticated attackers can exploit this flaw by guessing or enumerating attachment IDs, potentially leading to sensitive data exposure and unauthorized file retrieval.
Affected Version(s)
F70 Lead Document Download * <= 1.4.4