I have a scenario that I want to let people that visit my WordPress website download some PDFs. These PDFs go to my website as products of the Woocommerce plugin, so they are stored on the folder uploads/woocommerce_uploads. At the moment, I don't want people to go through all the process of buying a free product. If the user is already logged in, and has the necessary privileges, I show a custom download button, which points directly to the PDF's path in the uploads folder. Something like this:
Does this direct link to a PDF files as a way to let people download them open any vulnerability or harm in any way my WordPress website?