PT-2021-20607 · WordPress · Wordpress Download Manager

Ramuel Gall · Published 2021-08-02 · Updated 2021-08-12 · CVE-2021-34639

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: WordPress Download Manager versions 3.1.24 and prior versions

Description: The issue allows authenticated users with Author+ permissions to upload files with double extensions, such as "payload.php.png", which can be executable in certain configurations. This poses a significant risk to web sites. Researchers have identified that the patch for this issue may not be effective, and the vulnerability can still be exploited using double extensions.

Recommendations: For WordPress Download Manager versions 3.1.24 and prior, consider disabling file upload functionality for authenticated users until a fully effective patch is available. Restrict access to the file upload feature to minimize the risk of exploitation. Avoid using double extensions in file uploads until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Unrestricted File Upload

Weakness Enumeration

CWE-434

CWE-646

Related Identifiers

CVE-2021-34639

Affected Products

Wordpress Download Manager

References · 5

• https://osv.dev/vulnerability/CVE-2021-34639 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-34639 · Security Note
• https://t.me/cibsecurity/26910 · Telegram Post
• https://wordfence.com/blog/2021/07/wordpress-download-manager-vulnerabilities · Note
• https://t.me/nekaspersky/1100 · Telegram Post