The SocialV WordPress theme contains a missing authorization (CWE-862) vulnerability in the 'socialv_send_download_file' function. This flaw permits authenticated users with low-level privileges (Subscriber and above) to bypass capability checks and download arbitrary files from the server. The vulnerability affects all versions up to 2.0.15 and is rated medium severity with a CVSS 3.1 score of 6.5 (Network attack vector, low attack complexity, privileges required, no user interaction, unchanged scope, high confidentiality impact, no integrity or availability impact). No patch or official fix has been documented in the provided information.

An attacker with at least Subscriber-level access can exploit this vulnerability to download arbitrary files from the target system, potentially exposing sensitive data. The confidentiality of the system is impacted, but integrity and availability are not affected. There are no known exploits in the wild currently.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict user roles to trusted users only and monitor for suspicious file access activities. Avoid granting Subscriber or higher privileges to untrusted users. Follow updates from the vendor iqonicdesign for any forthcoming patches or official mitigations.