Description

WordPress Plugin WordPress Download Manager is prone to multiple security bypass vulnerabilities. Attackers can exploit these vulnerabilities to perform otherwise restricted actions and subsequently delete or update otherwise restricted files. WordPress Plugin WordPress Download Manager version 2.6.92 is vulnerable; prior versions may also be affected.

Remediation

Update to plugin version 2.6.93 or latest

References

http://secunia.com/advisories/59925/

Related Vulnerabilities

WordPress Plugin PhoneTrack Meu Site Manager Cross-Site Scripting (0.1)

Atlassian Jira Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2017-16863)

Joomla Missing Authentication for Critical Function Vulnerability (CVE-2019-10946)

WordPress Plugin Contact Form 7 Multi-Step Addon Malicious Code (1.0.5)

WordPress Plugin Formidable Forms-Contact Form, Survey, Quiz, Calculator & Custom Form Builder Multiple Vulnerabilities (5.5.4)

Severity

High

Classification

CWE-284 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Tags

Missing Update Authentication Bypass