Well, AUTH_KEY and it´s brothers where introduced in WordPress 2.6 to improve safety for logged in users. They are used to encrypt and validate the information in your backend login cookie.
While revealing the AUTH_KEY alone might not be a real security issue, you should nevertheless not output/use this anywhere to give less surface for attacks.
Furthermore I don´t see why you would use the AUTH_KEY to prepare a folder/download link. I think it would be much better to use something like time() to generate folder names if you want randomness or uniqueness or whatever without compromising the security of the system.
Update: I opened a thread in the plugins support area. Let´s see if the author responds to it.
Related Posts:
- Unwanted Links and Spam WordPress Pages and Posts
- What security concerns should I have when setting FS_METHOD to “direct” in wp-config?
- What Are Security Best Practices for WordPress Plugins and Themes? [closed]
- Are WordPress Plugins essential?
- What are the common security flaws I need to look for? [closed]
- Why “Contact Form 7” doesn’t update PHPmailer library?
- Preserve custom URL parameter on more pages
- Secure WordPress paid plugin
- How to make media upload private? [duplicate]
- Does WordPress contain “default” anti-SQL injection code that responds with a 404 error?
- What does a security risk in a plugin look like?
- Which method is best to enqueue scripts
- WordPress Capabilities: edit_user vs edit_users
- How to make WordPress use protocol indepentent upload files?
- Why am I sometimes getting a 404 error when I try to update a page with Elementor?
- Woocommerce different URL for every table placed in the restaurant
- Should I use RIPS tool to test my themes and plugins?
- Why users disable the WordPress update?
- Add query string to plugin URL
- How many security plugins are too many? [closed]
- Will WordPress username displayed somewhere in the site?
- Upgrading WordPress 4.0 asks for FTP password
- Questions about brute force attacks on the admin username, coming from amazon IP addresses
- Why Better WP security plugin returns 418 I’m a Teapot “error”?
- How to limit WordPress pages during updates?
- rms_unique_wp_mu_pl_fl_nm.php
- Security checking in meta_box save is reluctant?
- Find the URL of the current plugin directory
- Custom page slug without creating a WP page
- What is an arbitrary URL?
- How To Clean The Malware Infected & Hacked WordPress Websites? [duplicate]
- wp_create_nonce function doesn’t work inside a plugin?
- Upgraded to latest version – 3.0.3 and Now I get a “sufficient permissions to access this page” error
- Headers Content-Security-Policy CSP Major Issue
- How to make a proper custom post type link
- Nonce failing on form submission
- Why WordPress plugin url ajax doesn’t work?
- Added slug after URL permalink last slash returns different content
- Is there a hook to Intercept al urls from a webpage and redirect to a page
- WordPress shows error related to allow_url_fopen
- Subdomains with almost the same content
- Malware installation during plugin update?
- change content based on url per plugin
- I should enable automatic updates?
- Can some vulnerabilities in plugins be exploited even when the plugin is inactive?
- Prevent direct access to WordPress plugin assets?
- How to protect WordPress from security scanner [closed]
- Too many login attempts
- Website show Google Ads when we have no Google Ads linked to our website
- Vulnerability Concern From the Plugin or From Not Updating the Plugin?
- Custom API plugin to execute 3rd party API to retrieve data
- correctness of URL
- how do I secure my WP website from hackers? [closed]
- Chrome Dev Tools console says every page in my blog has link to http://maps.google.com [closed]
- How do I convert my WordPress website to be domain agnostic?
- How to pass a query string to another page on the same site?
- Webservice credential storage [duplicate]
- Scrape a webpage for image and add it to post
- Change url of posts with keywords
- Regarding plugin security
- How do I determine if the user who registered is not spam?
- Is this plugin safe to run?
- Is the Block Bad Queries Plugin Still Relevant?
- Hide plugins and theme from public
- Offer Download Links for Product Images
- Security of a WordPress Plugin
- Redirect unloggedin users
- Change language on website and change currency with url query
- How can I disable new plugin and theme install, but allow updates?
- Validating ajax search
- WordPress disable direct access of files in WordPress installation path
- How to create a folder in wordpress that will contain pages?
- Asking help regarding potential malware
- prevent anonymous access to WordPress site (non-admin site)
- How to allow URL with filename & extension in wordpress?
- Bing/msn bots is heavily requesting random of my website
- Securing a plugin pop-up window
- Automatic set a featured image from the first image’s url (or tag) in the article
- WordPress website giving 404
- Keeping original URL
- How to link file or image from wordpress plugin dir to theme by using themes function.php, is it possible?
- Being hacked. Is there a list of WordPress security holes I can check against?
- Images not showing on homepage after migration [duplicate]
- How can i see/log all requests coming from a registration form (not from the UI)?
- Write mysql credentials in plugin
- Creating custom URL for async content
- Site is continuously accessing by several IPs
- URL RewriteRule doesn’t work when using WP Database Participants in my WordPress website
- SWF in wordpress post
- Display Plugin information on specific url
- How to get the real address from a url (permalink)
- File permissions for wp-minify plugin
- Remove base from the custom post type URL [duplicate]
- WP Job Manger change jobs url (NOT slug)
- What is the recommended way to be notified of security updates to my plugins? [closed]
- HTML link within my plugin settings page
- How to resolve these findings from security audit
- Why plugin’s icon for the menu not found?
- How to change all the urls of the WordPress site?
- Stop the user if login from the cookies