Attachments not protected and extra div

I took a look at the plugin’s WPPCP_Post_Attachments class (class-wppcp-post-attachments.php) and see how you are using the permissions to show or not show the download links, but are not using the permissions to control the download. A few extra lines in file_attachment_download() would prevent unauthorized downloads. See below.

i think users of your plugin are under the impression that managed file attachments are protected, and that someone could not post a link to the files that anyone else could use.

foreach ($post_attachments as $key => $attach_data) {
	if($attach_data['attach_id'] == $wppcp_file_id){
		// echo "<pre>";print_r($attach_data);exit;

		if ($this->verify_download_permission($attach_data)){
			$file_mime_type = isset($attach_data['mime']) ? $attach_data['mime'] : '';
			if($file_mime_type != ''){

				header('Cache-Control: public');
				header('Content-Description: File Transfer');
				header('Content-disposition: attachment;filename='.basename($file_dir));

				header('Content-Type: '. $file_mime_type);
				header('Content-Transfer-Encoding: binary');
				header('Content-Length: '. filesize($file_dir));
				readfile($file_dir);
				exit;
			}
		} else {
			echo 'You need to <a href="'.wp_login_url().'">login</a> before downloading this file.';
			exit();
		}
	}
}