The 'Download Plugins and Themes in ZIP from Dashboard' WordPress plugin suffers from a CSRF vulnerability (CWE-352) due to inadequate nonce validation on the download_plugin_bulk and download_theme_bulk functions. This flaw allows unauthenticated attackers to coerce site administrators into executing actions that archive all site plugins and themes and store them in the uploads directory. The vulnerability affects all versions up to and including 1.9.6. The CVSS 3.1 base score is 4.3 (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N), reflecting a network attack vector with low complexity, no privileges required, but requiring user interaction, causing limited integrity impact and no confidentiality or availability impact. There is no vendor advisory or patch information available at this time.

Successful exploitation allows an attacker to cause an administrator to archive all plugins and themes and place the archive in the wp-content/uploads/ directory. This results in limited integrity impact as unauthorized modification of site files occurs. There is no direct confidentiality or availability impact reported. The attack requires user interaction (administrator clicking a crafted link). No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should avoid clicking on untrusted links and consider disabling or removing the vulnerable plugin if possible. Monitoring for suspicious activity related to plugin/theme archiving may help detect exploitation attempts.