YITH plugins by YITHEMES <= (Various Versions) - Missing Authorization

Several YITHEMES plugins for WordPress are vulnerable to authorization bypass due to a missing capability check on the create_log_file function. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to download the logs of the plugin which can contain sensitive information. Please note that the unpatched plugins from this developer are the FREE versions of the plugin that were available on the WordPress.org repository. The developer is still maintaining the premium versions of the plugins which have been patched.