PT-2021-16202 · WordPress · Simple Download Monitor

Apple502J · Published 2021-11-08 · Updated 2021-11-11 · CVE-2021-24698

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Simple Download Monitor WordPress plugin versions prior to 3.9.6

Description The issue allows users with a role as low as Contributor to remove thumbnails from downloads they do not own, even if they cannot normally edit the download.

Recommendations For versions prior to 3.9.6, update to version 3.9.6 or later to resolve the issue.

Exploit

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

CVE-2021-24698

Affected Products

Simple Download Monitor

References · 5

• 🔥 https://wpscan.com/vulnerability/1fda1356-77d8-4e77-9ee6-8f9ceeb3d380 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-24698 · Security Note
• https://osv.dev/vulnerability/CVE-2021-24698 · Vendor Advisory
• https://t.me/cvenotify/23148 · Telegram Post
• https://t.me/cibsecurity/32002 · Telegram Post