title: Download Plugin < 1.6.1 - Subscriber+ Arbitrary Plugin Activation
description: The Download Plugin WordPress plugin before 1.6.1 does not have capability and CSRF checks in the dpwap_plugin_activate AJAX action, allowing any authenticated users, such as subscribers, to activate plugins that are already installed.
problem types: CWE-732 Incorrect Permission Assignment for Critical Resource
affected:
{
product: Download Plugin
vendor: Unknown
versions:
lessThan: 1.6.1, status: affected, version: 1.6.1, versionType: custom
}