Description
The Lana Downloads Manager WordPress plugin before 1.10.0 does not validate user input used in a path, which could allow users with an admin role to perform path traversal attacks and download arbitrary files on the server
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | Lana Downloads Manager | < 1.10.0 | 1.10.0 |
References
- https://wpscan.com/vulnerability/05c664e8-110e-4a31-8377-41a0422508a7/ exploit vdb-entry technical-description