// includes/ar-secure-download.php lines 21-37
if (!function_exists('ar_decrypt_file_path')){
    // Function to decrypt the file path
    function ar_decrypt_file_path($encrypted_data, $key) {
        // Ensure key length is 32 bytes (256 bits)
        $key = substr(hash('sha256', $key, true), 0, 32);
    
        // Decode the encrypted data
        $data = base64_decode($encrypted_data);
        $parts = explode('::', $data, 2);
    
        if (count($parts) < 2) {
            return false; // Invalid data format
        }
    
        $iv = $parts[0];
        $encrypted = $parts[1];
    
        // Decrypt the file path
        return openssl_decrypt($encrypted, 'AES-256-CBC', $key, 0, $iv);
    }
}

---

// includes/ar-secure-download.php lines 41-53
if (!function_exists('ar_validate_and_serve_file')){
    function ar_validate_and_serve_file($encrypted_file_path) {
        // Define the secret key for encryption/decryption
        $secret_key = get_option('ar_licence_key'); // Change this to a secure key
    
        // Decrypt the file path
        $file_path = ar_decrypt_file_path($encrypted_file_path, $secret_key);
    
        // Get the uploads directory path dynamically
        $uploads_dir = wp_upload_dir(); // Get the upload directory information
        $allowed_directory = $uploads_dir['basedir']; // Base directory for uploads
        $full_file_path = $allowed_directory . '/' . $file_path;

diff -ru /home/deploy/wp-safety.org/data/plugin-versions/ar-for-woocommerce/8.40/includes/ar-secure-download.php /home/deploy/wp-safety.org/data/plugin-versions/ar-for-woocommerce/8.41/includes/ar-secure-download.php
--- /home/deploy/wp-safety.org/data/plugin-versions/ar-for-woocommerce/8.40/includes/ar-secure-download.php	2026-06-15 01:33:46.000000000 +0000
+++ /home/deploy/wp-safety.org/data/plugin-versions/ar-for-woocommerce/8.41/includes/ar-secure-download.php	2026-07-02 00:02:22.000000000 +0000
@@ -17,6 +17,19 @@
 }
 
 /************* Function to decrypt the file path *******************/
+if (!function_exists('ar_get_secure_download_secret')){
+    function ar_get_secure_download_secret() {
+        $secret = get_option('ar_secure_download_secret');
+
+        if (!is_string($secret) || strlen($secret) < 32) {
+            $secret = wp_generate_password(64, true, true);
+            update_option('ar_secure_download_secret', $secret, false);
+        }
+
+        return $secret;
+    }
+}
+
 if (!function_exists('ar_decrypt_file_path')){
     // Function to decrypt the file path
     function ar_decrypt_file_path($encrypted_data, $key) {
@@ -24,7 +37,11 @@
         $key = substr(hash('sha256', $key, true), 0, 32);
     
         // Decode the encrypted data
-        $data = base64_decode($encrypted_data);
+        $data = base64_decode($encrypted_data, true);
+        if ($data === false) {
+            return false;
+        }
+
         $parts = explode('::', $data, 2);
     
         if (count($parts) < 2) {
@@ -33,41 +50,72 @@
     
         $iv = $parts[0];
         $encrypted = $parts[1];
+
+        if (strlen($iv) !== openssl_cipher_iv_length('AES-256-CBC')) {
+            return false;
+        }
     
         // Decrypt the file path
         return openssl_decrypt($encrypted, 'AES-256-CBC', $key, 0, $iv);
     }
 }
+/************* Function to validate a decrypted uploads path *******************/
+if (!function_exists('ar_validate_secure_download_path')){
+    function ar_validate_secure_download_path($file_path, $allowed_directory) {
+        if (!is_string($file_path) || $file_path === '' || strpos($file_path, "\0") !== false) {
+            return false;
+        }
+
+        $file_path = str_replace('\\', '/', $file_path);
+
+        if (preg_match('#(^/|^[A-Za-z]:|://)#', $file_path) || preg_match('#(^|/)\.\.(/|$)#', $file_path)) {
+            return false;
+        }
+
+        $valid_extensions = array('gltf', 'glb', 'usdz');
+        $ext = strtolower(pathinfo($file_path, PATHINFO_EXTENSION));
+        if (!in_array($ext, $valid_extensions, true)) {
+            return false;
+        }
+
+        $allowed_directory = realpath($allowed_directory);
+        if (!$allowed_directory) {
+            return false;
+        }
+
+        $full_file_path = realpath($allowed_directory . '/' . ltrim($file_path, '/'));
+        if (!$full_file_path || !is_readable($full_file_path)) {
+            return false;
+        }
+
+        $allowed_directory = rtrim(wp_normalize_path($allowed_directory), '/') . '/';
+        $full_file_path_normalized = wp_normalize_path($full_file_path);
+
+        if (strpos($full_file_path_normalized, $allowed_directory) !== 0) {
+            return false;
+        }
+
+        return $full_file_path;
+    }
+}
 /************* Function to validate and serve the request *******************/
 if (!function_exists('ar_validate_and_serve_file')){
     function ar_validate_and_serve_file($encrypted_file_path) {
         // Define the secret key for encryption/decryption
-        $secret_key = get_option('ar_licence_key'); // Change this to a secure key
+        $secret_key = ar_get_secure_download_secret();
     
         // Decrypt the file path
         $file_path = ar_decrypt_file_path($encrypted_file_path, $secret_key);
+        if ($file_path === false) {
+            wp_die('Invalid file request.');
+        }
     
         // Get the uploads directory path dynamically
         $uploads_dir = wp_upload_dir(); // Get the upload directory information
         $allowed_directory = $uploads_dir['basedir']; // Base directory for uploads
-        $full_file_path = $allowed_directory . '/' . $file_path;
-    
-        // Referrer Check: Ensure the request is coming from a valid source
-        $referer = isset($_SERVER['HTTP_REFERER']) ? sanitize_text_field(wp_unslash($_SERVER['HTTP_REFERER'])) : '';
-        $valid_referer = home_url(); // You can set this to your site's URL or specific referrers
-    
-        if (strpos($referer, $valid_referer) !== 0) {
-            wp_die('Unauthorized access');
-        }
-        if (file_exists($full_file_path)) {
-            // Sanitize the file path to ensure it's safe.
-            $full_file_path = realpath($full_file_path);
-            
-            // Check if the file exists and is readable before proceeding
-            if (!$full_file_path || !is_readable($full_file_path)) {
-                wp_die('File not found or inaccessible.');
-            }
+        $full_file_path = ar_validate_secure_download_path($file_path, $allowed_directory);
 
+        if ($full_file_path) {
 
             // Prevent caching
             header('Cache-Control: no-store, no-cache, must-revalidate, max-age=0');
@@ -92,7 +140,7 @@
     }
 }
 // Verify the nonce before processing
-if ( ! isset( $_GET['_wpnonce'] ) || ! wp_verify_nonce( sanitize_text_field( wp_unslash( $_GET['_wpnonce'] ) ), 'ar_secure_nonce' ) ) {
+if ( ! isset( $_GET['_wpnonce'] ) || ! wp_verify_nonce( sanitize_text_field( wp_unslash( $_GET['_wpnonce'] ) ), 'ar_secure_download_nonce' ) ) {
     // If the nonce is invalid, stop the process
     wp_die( __( 'Security check failed.', 'ar-for-woocommerce' ) );
 }