CVE-2024-7501 is a CSRF vulnerability in the WordPress plugin 'Download Plugins and Themes in ZIP from Dashboard' affecting all versions up to 1.8.7. The issue stems from missing or incorrect nonce validation in the download_theme() function, which enables an attacker to coerce an authenticated administrator into downloading arbitrary themes through a crafted request. In versions before 1.8.6, the vulnerability is more critical as it allows downloading the entire site’s files. The vulnerability has a CVSS 3.1 base score of 4.2, reflecting a medium impact primarily on confidentiality and integrity with no impact on availability. There is no vendor advisory or patch information provided, and no known exploitation in the wild has been reported.

An attacker can exploit this CSRF vulnerability by tricking an authenticated site administrator into performing unintended downloads of themes or, in older versions, the entire site’s files. This could lead to unauthorized disclosure of site content. The impact is limited to confidentiality and integrity with no direct effect on availability. The vulnerability requires user interaction (UI:R) and has a high attack complexity (AC:H), reducing the likelihood of exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should avoid clicking on suspicious links and consider restricting administrative access or implementing additional CSRF protections at the site level. Monitor official wpcodefactory channels for updates and patches addressing this vulnerability.