CVE-2022-3076

CVE-2022-3076: CM Download Manager < 2.8.6 - Admin+ Arbitrary File Upload

Vendor Unknown

Product CM Download Manager

Weakness CWE-434 · Unrestricted file upload

Published September 26, 2022

Last update May 22, 2025

View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

The CM Download Manager WordPress plugin before 2.8.6 allows high privilege users such as admin to upload arbitrary files by setting the any extension via the plugin's setting, which could be used by admins of multisite blog to upload PHP files for example.

Key dates

02Disclosure timeline

September 26, 2022 CVE published

May 22, 2025 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2022-3076 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/434.html

Related vulnerabilities

04Related CVE

CVE-2026-10071 Interinfo｜DreamMaker - Arbitrary File Upload CVE-2018-25409 SIM-PKH 2.4.1 Arbitrary File Upload via aksi_pengurus.php CVE-2026-5482 Remote Code Execution via Unrestricted File Upload in Responsive FileManager CVE-2026-40548 Unrestricted Upload of File with Dangerous Type in SOPlanning CVE-2026-6933 Premmerce Dev Tools <= 2.0 - Missing Authorization to Authenticated (Subscriber+) Remote Code Execution via Plugin Creation