CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
What the vulnerability does
Authenticated Directory Traversal in WordPress Download Manager <= 3.1.24 allows authenticated (Contributor+) users to obtain sensitive configuration file information, as well as allowing Author+ users to perform XSS attacks, by setting Download template to a file containing configuration information or an uploaded JavaScript with an image extension This issue affects: WordPress Download Manager version 3.1.24 and prior versions.
Explanation of Vulnerability in Simple Terms
WordPress Download Manager version 3.1.24 contains a path traversal vulnerability that allows authenticated users to read files outside the intended directory. An attacker with low-level site access can craft requests to access sensitive files on the server, such as configuration files or other private data. This affects confidentiality but not integrity or availability.
What an attacker can do
Read arbitrary files on the server outside the plugin's directory.
Potential impact on your site
Sensitive files (wp-config.php, .env, database backups) may be exposed to authenticated users.
Conditions required to exploit
Attacker must have a low-privilege WordPress account (e.g., subscriber or contributor role).
Key dates
External resources
Related vulnerabilities
