Research Plan: CVE-2026-24541 - Missing Authorization in Download After Email

Vulnerability Summary

The Download After Email plugin (versions <= 2.1.9) contains a missing authorization vulnerability in its initialization logic. Specifically, the plugin handles administrative actions—such as duplicating "Download" posts—within functions hooked to init or admin_init without verifying the user's capabilities or checking for a valid security nonce. This allows unauthenticated attackers to trigger these actions by sending crafted HTTP requests, leading to unauthorized data modification (e.g., mass-creating duplicate posts).

Attack Vector Analysis

• Endpoint: Any frontend or backend page that triggers the init hook (e.g., /, /wp-admin/admin-ajax.php).
• HTTP Parameter: dae_duplicate (GET or POST).
• Authentication: None required (Unauthenticated).
• Preconditions: At least one dae_download post must exist in the database to be duplicated.

Code Flow

1. Entry Point: The plugin registers a function dae_post_types_init to the init hook in includes/post-types.php.
2. Hook Registration: add_action( 'init', 'dae_post_types_init' ); (Line 9, includes/post-types.php).
3. Execution: When WordPress initializes, dae_post_types_init