Description
WordPress Plugin Download Manager is prone to a directory traversal vulnerability because it fails to sufficiently verify user-supplied input. Exploiting this issue can allow an attacker to obtain sensitive information that could aid in further attacks. WordPress Plugin Download Manager version 3.2.54 is vulnerable; prior versions may also be affected.
Remediation
Update to plugin version 3.2.55 or latest
References
https://sploitus.com/exploit?id=WPEX-ID:2A440E1A-A7E4-4106-839A-D93895E16785
https://plugins.svn.wordpress.org/download-manager/trunk/readme.txt
Related Vulnerabilities
MySQL CVE-2019-2503 Vulnerability (CVE-2019-2503)
CakePHP Cross-Site Request Forgery (CSRF) Vulnerability (CVE-2015-8379)
MySQL CVE-2013-2376 Vulnerability (CVE-2013-2376)
WordPress Plugin Custom CSS Pro Cross-Site Request Forgery (1.0.3)
Apache Traffic Server Uncontrolled Resource Consumption Vulnerability (CVE-2018-8005)