CVE-2014-5465

Name of the Vulnerable Software and Affected Versions Download Shortcode plugin versions 0.2.3 and earlier

Description The issue allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter. This is a directory traversal vulnerability in the force-download.php file.

Recommendations For Download Shortcode plugin versions 0.2.3 and earlier, consider updating to a version later than 0.2.3 to resolve the issue. As a temporary workaround, consider restricting access to the force-download.php file until a patch is available. Avoid using the file parameter in the affected endpoint until the issue is resolved.