What the vulnerability does
01Description
The Download Panel plugin for WordPress is vulnerable to unauthorized settings modification due to a missing capability check on the 'wp_ajax_save_settings' AJAX action in all versions up to, and including, 1.3.3. This is due to the absence of any capability verification in the `dlpn_save_settings()` function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to arbitrarily modify plugin settings including display text, download links, button colors, and other visual customizations.
Explanation of Vulnerability in Simple Terms
02Summary
Download Panel versions 1.3.3 and earlier lack proper authorization checks, allowing authenticated users to modify content they should not have access to. An attacker with a low-privilege account can alter data through the panel without proper permission validation. The vulnerability affects the integrity of managed content but does not expose sensitive information or disrupt availability.
What an attacker can do
03Attacker Capabilities
Modify or alter content in the Download Panel without proper authorization.
Potential impact on your site
04Site Impact
Unauthorized users can alter downloaded files, descriptions, or panel settings, compromising content integrity.
Conditions required to exploit
05Prerequisites
Attacker must have a low-privilege user account on the site.
Key dates
06Disclosure timeline
November 18, 2025
CVE published
April 8, 2026
Record updated
