WP-Download 1.2 is vulnerable to a SQL-Injection Vulnerability. The dl_id parameter in "wp-download.php" is not correctly sanistised.

An attacker could use this vulnerability to retrieve usernames and passwords and potentially compromise your blog!

This bug has been reported in version 1.2, but it is likely that older versions are affected.

Please upgrade to version 1.2.1 which addresses this issue.

This vulnerability was discovered by BL4CK. A public exploit has been released into the wild and is available on Milw0rm.