---
id: CVE-2025-14633
title: >-
  The F70 Lead Document Download plugin for WordPress is vulnerable to
  unauthorized access of data due to a missing capability check on the
  'file_download' function in all versions up to, and including, 1.4.4
summary: >-
  The F70 Lead Document Download plugin for WordPress is vulnerable to
  unauthorized access of data due to a missing capability check on the
  'file_download' function in all versions up to, and including, 1.4.4. This
  makes it possible for un…
severity: medium
cvss: 5.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N'
cwe:
  - CWE-862
published: '2025-12-20'
updated: '2026-10-01'
sourceUpdated: '2026-10-01T16:10:00.257'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-14633'
references:
  - url: >-
      https://plugins.trac.wordpress.org/browser/f70-lead-document-download/tags/1.4.4/includes/class.download.php#L61
    label: security@wordfence.com
  - url: >-
      https://plugins.trac.wordpress.org/browser/f70-lead-document-download/trunk/includes/class.download.php#L61
    label: security@wordfence.com
  - url: >-
      https://www.wordfence.com/threat-intel/vulnerabilities/id/bba22270-de9b-4651-8180-c077ef113112?source=cve
    label: security@wordfence.com
tags:
  - nvd
epss: 0.00275
epssPercentile: 0.19746
ingestedAt: '2026-10-01T18:55:42.307Z'
---

## Overview

The F70 Lead Document Download plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'file_download' function in all versions up to, and including, 1.4.4. This makes it possible for unauthenticated attackers to download any file from the WordPress media library by guessing or enumerating WordPress attachment IDs.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.