WP-DownloadCounter
WP-DownloadCounter has one disclosed vulnerability in the WordSec catalog, all reported in 2025; it remains unpatched as of September 2026. Their average CVSS score is 4.3, and the most serious one scores 4.3 out of 10.
The most common weakness is Cross-Site Request Forgery (CSRF), behind 1 of the records (100%).
The one issue recorded for WP-DownloadCounter has no published fix yet, which makes virtual patching the only reliable mitigation. The oldest unresolved one dates back to 2025.
All of these findings were reported by Nguyen Xuan Chien. WP-DownloadCounter is installed on roughly 100 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 2.7.3.
CVE-2025-52790WP-DownloadCounter <= 1.01 - Cross-Site Request Forgery
Read the full analysisVulnerability Records
WP-DownloadCounter
Author
r-win
Since WordPress does offer attaching downloads to pages, but doesn’t keep track of statistical information about these downloads, I wrote this plugin. I should mention statistical information is a big word for just another download counter, since that is main purpose of this plugin. Features: Keeps track of the amount of downloads of a certain file. Keeps track of the last download time Allows you to reset the counter Allows you to add counters to both internal and external urls Can use fancy urls (like /downloads/file.zip) Can print the amount of downloads, the filesize and the last modified date in a post. Arbitrary section Using tags in your posts When writing a post or a page, you may want to add the URL or the amount of downloads in your post. Using [ download(downloadname) ] (without the spaces) will be replaced with the download url, [ downloadcounter(downloadname) ] will be replaced with the amount of downloads, [ downloadsize(downloadname) ] will print the size of the download (in GB, MB, kB or B), [ downloadupdated(downloadname) ] will print the last modified date, using the WordPress setting you’ve specified for the date format. When creating a link, you could, for instance, use Download (of course, again, without the spaces within the [] brackets). Finally, when using downloadsize of downloadupdated, you can specify one extra argument. With downloadsize, you can add ,false to prevent the usage of the GB, MB, kB or B postfixes. So, for example, using [ downloadsize(file.zip, false) ] will just display the size in bytes. With downloadupdated, you can enter a PHP date format string as extra argument. For example, [ downloadupdated(file.zip, d-m-Y) ] will display a date like 27-11-2008. Retrieving download information from PHP Since version 0.6 is it possible to get information about the downloads using PHP, so you can use this information directly in your templates or in you own plugins. Only one function is important at the moment: download_information($download_name, $return_information = DOWNLOAD_URL | DOWNLOAD_AMOUNT) This function will return an array with the requested information. You can specify what information to return by the argument $return_information. The file downloadcounter-options.php contains the correct define statements which can be used. Currently only URL, Amount, Size and Last Modified Date are available. Using the code $info = download_information(wp-downloadcounter.zip, DOWNLOAD_URL | DOWNLOAD_AMOUNT | DOWNLOAD_SIZE | DOWNLOAD_LASTMODIFIED); var_dump($info); returns: array(4) { ["url"]=> string(73) "http://projects.bovendeur.org/downloads/wp-downloadcounter.zip" ["amount"]=> string(4) "1878" ["size"]=> int(11006) ["lastmodified"]=> int(1228157426) }
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C