Description
WordPress Plugin Download Manager is prone to a deserialization vulnerability. Attackers can possibly exploit this issue to call files using a PHAR wrapper that will deserialize and call arbitrary PHP Objects that can be used to perform a variety of malicious actions, granted a POP chain is also present. WordPress Plugin Download Manager version 3.2.49 is vulnerable; prior versions may also be affected.
Remediation
Update to plugin version 3.2.50 or latest
References
Related Vulnerabilities
Apache Tomcat Other Vulnerability (CVE-2007-2449)
WordPress Plugin Category Grid View Gallery Cross-Site Scripting (2.3.3)
WordPress Plugin 404 to 301-Redirect, Log and Notify 404 Errors Security Bypass (3.0.7)
Oracle Database Server CVE-2014-6453 Vulnerability (CVE-2014-6453)
Jboss EAP Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2016-7061)