CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
What the vulnerability does
The wp-downloadmanager WordPress plugin, in version 1.68.11 (also affecting the 6.9.4 release line), allows an admin-privileged user (current_user_can('manage_downloads')) to upload arbitrary files via download-add.php with no extension or MIME-type validation of any kind - no wp_check_filetype_and_ext, no validate_file, and no extension blocklist exist anywhere in the upload handler.
Explanation of Vulnerability in Simple Terms
wp-downloadmanager versions before 1.69 allow administrators to upload files without proper type validation. An attacker with admin access can upload executable files (such as PHP scripts) to the site, potentially gaining the ability to run arbitrary code. This vulnerability requires high-level privileges to exploit but poses a severe risk if admin credentials are compromised.
What an attacker can do
Upload and execute malicious files on the site with admin privileges.
Potential impact on your site
If admin credentials are compromised, attackers can upload malicious code and take full control of your site.
Conditions required to exploit
Attacker must have administrator-level access to the WordPress site.
Key dates
External resources
Related vulnerabilities
