CVE-2017-1002008

Name of the Vulnerable Software and Affected Versions membership-simplified-for-oap-members-only version 1.58

Description The issue concerns a lack of proper access control in the file download functionality. Specifically, the download.php file in the membership-simplified-for-oap-members-only plugin does not verify whether a user is logged in and has the necessary privileges to download files.

Recommendations For version 1.58, consider restricting access to the download.php file until a proper fix is implemented to ensure that only logged-in users with download privileges can access the file download functionality.