Authorization Bypass in dFactory Download Attachments Plugin by WordPress

CVE-2025-49995

What is CVE-2025-49995?

A vulnerability exists in the dFactory Download Attachments plugin that allows users to bypass authorization controls due to improperly configured access permissions. This flaw enables potential exploitation by malicious actors to gain unauthorized access to sensitive files, revealing a critical need for users to monitor and update their installations, particularly those using versions from n/a through 1.3.1.

References