CVE-2025-60148

The Subscribe to Download plugin for WordPress versions up to and including 2.0.9 contains a missing authorization vulnerability. This flaw arises from incorrectly configured access control security levels, allowing unauthenticated or low-privileged users to execute actions that should require higher privileges [1].

Exploitation does not require authentication; an attacker can send crafted requests to the vulnerable plugin to bypass authorization checks. The attack surface is broad, as the plugin is widely used, and the vulnerability can be triggered without any special network position [1].

Successful exploitation could allow an attacker to access or modify protected features, such as downloading premium content or manipulating subscription settings, potentially leading to data exposure or unintended content access [1].

The vendor has released version 2.1.0 which addresses the issue. Users are strongly advised to update immediately. Auto-update can be enabled for vulnerable plugins via Patchstack [1].