The vulnerability CVE-2024-7848 affects the deepakkite WordPress plugin 'File Sharing & Download Manager – User Private Files' in all versions up to 2.1.0. It is caused by improper authorization checks on the 'docid' user-controlled key within the 'dpk_upvf_update_doc' endpoint, allowing authenticated users with minimal privileges to bypass access controls and retrieve private files of other users. This is classified as CWE-639: Authorization Bypass Through User-Controlled Key. The CVSS v3.1 base score is 4.3, reflecting a network attack vector with low complexity, requiring low privileges, no user interaction, and resulting in limited confidentiality impact without affecting integrity or availability.

An attacker with subscriber-level or higher privileges can access private files of other users without authorization. This compromises confidentiality of user data stored via the plugin. There is no indication of impact on data integrity or availability. The vulnerability does not require user interaction and can be exploited remotely over the network.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict plugin usage to trusted users only and consider disabling the plugin if private file confidentiality is critical. Monitor for vendor updates or security advisories regarding this vulnerability.