CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
What the vulnerability does
The Download Manager plugin for WordPress is vulnerable to unauthorized access of data due to an improper authorization check on the 'protectMediaLibrary' function in all versions up to, and including, 3.2.89. This makes it possible for unauthenticated attackers to download password-protected files.
Explanation of Vulnerability in Simple Terms
Download Manager versions 3.2.89 and earlier contain an authentication bypass vulnerability. An attacker can read sensitive files without logging in, including configuration data and potentially other users' information. The vulnerability requires no user interaction and is remotely exploitable over the network. Site administrators should update immediately to a patched version.
What an attacker can do
Read sensitive files and data without authentication.
Potential impact on your site
Attackers can access confidential files, configuration data, and potentially user information without logging in.
Conditions required to exploit
Network access only; no authentication or user interaction required.
Key dates
External resources
Related vulnerabilities
