The sell-downloads plugin prior to 1.0.8 for WordPress has insufficient restrictions on brute-force guessing of purchase IDs.
codepeople sell downloads