The code in dukapress/download.php does not sanitize user input before passing via $_GET['id'] to query() allowing SQL to be injected. The user is not required to be logged into wordpress in order to exploit this vulnerability. 9:$sql = "SELECT saved_name, real_name, count, TIMESTAMPDIFF(SECOND,sent_time,NOW()) as time_diff FROM `{$table_name2}` WHERE saved_name='{$_GET['id']}'"; . . . 26: $wpdb->query("UPDATE {$table_name2} SET count={$download_count} WHERE saved_name='{$_GET['id']}'");