Description
WordPress Plugin Download Manager is prone to a directory traversal vulnerability because it fails to sufficiently verify user-supplied input. Exploiting this issue can allow an attacker to obtain sensitive information that could aid in further attacks. WordPress Plugin Download Manager version 3.2.54 is vulnerable; prior versions may also be affected.
Remediation
Update to plugin version 3.2.55 or latest
References
https://sploitus.com/exploit?id=WPEX-ID:2A440E1A-A7E4-4106-839A-D93895E16785
https://plugins.svn.wordpress.org/download-manager/trunk/readme.txt
Related Vulnerabilities
WordPress Plugin Website FAQ 'website-faq-widget.php' SQL Injection (1.0)
WordPress Plugin Wordfence Security-Firewall & Malware Scan Cross-Site Scripting (7.6.0)
WordPress Plugin Gwolle Guestbook Cross-Site Scripting (2.5.3)
WordPress Plugin WP Courses LMS Security Bypass (2.0.28)
WordPress Plugin GD bbPress Attachments Cross-Site Scripting (2.5)