Description
The Download Manager WordPress plugin before 3.3.71, Download Manager WordPress plugin before 7.5.9 does not have CSRF checks in some places, allowing attackers to make a logged in admin update its privacy and storage settings via a crafted link, including the credential that gates its unauthenticated maintenance endpoint.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | Download Manager | < 3.3.71, 4.0.0 – < 7.5.9 | 3.3.71 |
References
- https://wpscan.com/vulnerability/07ed3827-e52e-4021-91ed-511fc5f554ba/ exploit vdb-entry technical-description