Massive Security Hole with File Downloads

[bluedot]

----

[Bruce C]

I get a 404 error when I try something like that.

Have you encrypted your website? I'll run some more tests and see if I can replicate the situation.

[Ciderhelm]

Ace, I sent you a PM. I can confirm what Bluedot has posted.

[Cristián Lávaque]

Thank you guys. I emailed Jason.

[Jason Caldwell]

Thanks for reporting this important security issue.
~ We're investigating this now.

[Cristián Lávaque]

Awesome! Thanks Jason.

[Jason Caldwell]

Thanks for the heads up on this thread Cristián.

This major security issue has been resolved in the release of s2Member v110812.
Please see this update for details: viewtopic.php?f=46&t=14419

s2Member® v110812 Security Release ( now available! )
http://wordpress.org/extend/plugins/s2member/

IMPORTANT: This release addresses an important security vulnerability in previous releases of the s2Member Framework ( i.e. the free version of s2Member ). Sites with Download Options configured for s2Member should be advised to update to s2Member v110812+ as soon as possible to avoid possible exploits. Changelog is located here: http://wordpress.org/extend/plugins/s2member/changelog/

[bluedot]

Just installed, appears to have fixed it!

Big thanks for the quick turn around on this!

[Jason Caldwell]

Thanks for the follow-up.

Just installed, appears to have fixed it!

Big thanks for the quick turn around on this!

Very welcome. Thank you VERY much for reporting this!