Description

Unauthenticated Arbitrary File Download in OMGF Pro <= 5.2.7 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-13T14:17:03.590Z",
  "pubdate": "2026-08-13T14:17:03.590Z",
  "executiveSummary": "An unauthenticated arbitrary file download vulnerability exists in OMGF Pro versions 5.2.7 and below. This security flaw allows remote, unauthenticated attackers to retrieve sensitive files from the underlying server hosting the vulnerable application. The vulnerability poses a severe risk to confidentiality by potentially exposing configuration files, source code, system credentials, or other sensitive data accessible to the web server process. Exploitation requires network access to the target application and does not necessitate valid user credentials or elevated privileges. Given the nature of arbitrary file download vulnerabilities, successful exploitation can lead to complete compromise of sensitive application data and facilitate further targeted attacks against the hosting infrastructure.",
  "technicalDetails": "The vulnerability resides in the OMGF Pro plugin for WordPress, specifically affecting versions 5.2.7 and prior. The root cause stems from insecure handling of input parameters utilized in file retrieval or download functionalities, lacking proper sanitization, validation, or access control enforcement. Because the endpoint responsible for processing these requests is exposed without authentication requirements, remote threat actors can interact with the vulnerable component directly over the network.\nDuring a typical attack flow, an unauthenticated attacker crafts a malicious HTTP request directed at the vulnerable endpoint within OMGF Pro. By supplying specially crafted input parameters—such as traversal sequences or specific target file paths—the attacker forces the application to read and output the contents of arbitrary files from the filesystem. The vulnerable component processes the supplied path without restricting access to designated directories, leading to path traversal and unauthorized file retrieval.\nThe attack operates entirely over standard network protocols (HTTP/HTTPS) and targets the web application layer. The privilege requirement is non-existent, as the flaw can be exploited by unauthenticated external users. Payload behavior involves the traversal of directory structures to target sensitive system or application files. The post-exploitation impact includes the unauthorized exposure of critical data, such as database configuration files containing credentials, environment variables, or other sensitive assets residing on the server filesystem, thereby severely undermining the confidentiality posture of the affected system."
}