Detected Download Monitor plugin before 1.9.7 exposed the full download log CSV to unauthenticated users, revealing fields including User Login, User Email, User IP, and User Agent for every recorded download.
Log in to view the POC file snapshot cached by Shenlong Bot
Log in to view