Email Before Download
Email Before Download has 5 disclosed vulnerabilities in the WordSec catalog, reported between 2015 and 2024; all 5 are fixed as of September 2026. Their average CVSS score is 7.6, and the most serious one scores 9.8 out of 10. Severity breakdown: 2 critical and 1 high. 2017 was the busiest year with 2 disclosures.
The most common weakness is SQL Injection, behind 3 of the records (60%). Other recurring categories include Cross-Site Request Forgery (CSRF), Improper Input Validation.
Every one of the 5 issues recorded for Email Before Download has a vendor fix available, so running the current release closes all known holes.
3 independent researchers contributed these findings, most of them (2) reported by Clément Notin. Email Before Download is installed on roughly 5,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 0.
Email Before Download <= 3.6 - SQL Injection
Read the full analysisVulnerability Records

Email Before Download
Author
ashokaggarwal
6.x Release is Here! After a hiatus from EBD development, a community member has reached out and partnered with us to breathe life back into EBD! We have recently made updates to fix issues and enhance capabilities of EBD. Stay tuned for more to come in EBD v6.x and above! Email Before Download (EBD) presents your users with a form where they submit information, like their name and email address, prior to receiving a download. This plugin integrates with the popular Contact Form 7 and WordPress Download Monitor plugins, allowing you to create any form you like and manage/monitor your file downloads. You can also EXPORT a list of users that have downloaded files from the plug-in’s settings page. Prior to installing Email Before Download, please confirm each of the dependent plugins is already installed and working independently. As an option, you can configure Email Before Download to: Display a link to your file directly under the contact form once it is submitted. This happens dynamically, inline of your post/page. Send the user an email with a link and/or attachment to download your file. Both #1 and #2 Plugin Homepage with Live Demos and Test Download | Support Forums | Customer Feedback Page Usage Note: You can see screenshots at https://wordpress.org/extend/plugins/email-before-download/screenshots/ Create a contact form used by Email Before Download using Contact Form 7 and note the Contact Form ID Upload a file using Download Monitor and note the Download ID Navigate to the Post (or Page) you wish to include Add the following short code using the IDs collected in the first two steps [email-download download_id=”X” contact_form_id=”Y”] Plugin Homepage with Live Demos and Test Download: http://www.mandsconsulting.com/products/wp-email-before-download Please use the Support Forums for any questions and issues. Sometimes other users can help you as well.
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C