Download Attachments

Download Attachments has 4 disclosed vulnerabilities in the WordSec catalog, reported between 2023 and 2026; all 4 are fixed as of September 2026. Their average CVSS score is 6.2, and the most serious one scores 6.5 out of 10.

The most common weakness is Authorization Bypass Through User-Controlled Key, behind 2 of the records (50%). Other recurring categories include Cross-Site Scripting.

Every one of the 4 issues recorded for Download Attachments has a vendor fix available, so running the current release closes all known holes.

4 independent researchers contributed these findings, one record each. Download Attachments is installed on roughly 8,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.0.4.

Strategic Overview

Avg CVSSMedium

6.2/ 10

Patch Coverage100%

Open

Fixed

Get automatic notifications for all Download Attachments vulnerabilities before they are exploited.

Highest severity on recordCVSS 6.5CVE-2026-39616

Download Attachments <= 1.4.0 - Unauthenticated Insecure Direct Object Reference

Read the full analysis

Vulnerability Records

4 records


2026-02-10 00:00	Download Attachments <= 1.4.0 - Unauthenticated Insecure Direct Object Reference Download Attachments <= 1.4.0	`CVE-2026-39616`	6.5 Medium	Jakub Herman	Yes
2025-06-19 00:00	Download Attachments <= 1.3.1 - Unauthenticated Insecure Direct Object Reference Download Attachments <= 1.3.1	`CVE-2025-49995`	5.3 Medium	haudayroi	Yes
2024-06-03 16:38	Download Attachments <= 1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting Download Attachments <= 1.3	`CVE-2024-3230`	6.4 Medium	Krzysztof Zając	Yes
2023-02-13 00:00	Download Attachments <= 1.2.24 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Download Attachments <= 1.2.24	`CVE-2023-0076`	6.4 Medium	István Márton	Yes

Showing 1–4 of 4 reports

Latestv1.4.1

Download Attachments

Author

dFactory

4.5(46)

90/100

Last Updated

2026-05-26 (4mo ago)

Active Installs

8,000+

Downloads

228,108

Requires WP

6.0+

Requires PHP

7.0.0+

Tested up to

WP 7.0.4

Created

2013-11-29 (13y ago)

Download Attachments is a new approach to managing downloads in WordPress. Instead of bloated interface it enables simple, drag & drop and AJAX driven metabox where you can insert and manage your Media Library files and automatically or manually display them after, before or inside posts content. For more information, check out plugin page at dFactory site. Features include: Automatic or manual download links display Select post types where Download Attachments should be used Select list, table or sortable, dynamic table display style Downloads count Advanced attachments sorting Most Downloaded Attachments widget Drag & drop files ordering Based on Media Library attachments Easy customisation of Frontend & Backend display Pretty URLs for download links Encrypt URLs by default Customizable tamplates engine Custom download slug Custom permission for metabox display Option to exclude selected attachments from display Option to select from all Media Library files or only those attached to a post 2 shortcodes 5 functions and multiple filter hooks for developers Option to use attachment caption and/or description for download links description Compatible with WPML & Polylang .pot file for translations included Get involved Feel free to contribute to the source code on the dFactory GitHub Repository.

View on WordPress.org