PT-2022-9643 · WordPress · Download Manager

Diogo Real + 1 · Published 2022-03-07 · Updated 2022-04-12 · CVE-2021-25087

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Download Manager WordPress plugin versions prior to 3.2.35

Description The issue concerns a lack of authorization checks in some REST API endpoints, allowing unauthenticated attackers to call them. This could lead to sensitive information disclosure, including posts passwords and files Master Keys.

Recommendations For versions prior to 3.2.24, update to version 3.2.24 or later to fix the posts passwords disclosure issue. For versions prior to 3.2.25, update to version 3.2.25 or later to fix the files Master Keys disclosure issue. For versions prior to 3.2.35, update to version 3.2.35 or later to ensure all related issues are resolved.

Exploit

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2021-25087

Affected Products

Download Manager

References · 4

• 🔥 https://wpscan.com/vulnerability/d7ceafae-65ec-4e05-9ed1-59470771bf07 · Exploit
• https://osv.dev/vulnerability/CVE-2021-25087 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-25087 · Security Note
• https://t.me/cvenotify/27818 · Telegram Post