PT-2024-18821 · WordPress · Download Manager

M1Tz + 1 · Published 2024-06-13 · Updated 2025-03-11 · CVE-2024-2098

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Download Manager plugin for WordPress versions up to, and including, 3.2.89

Description The issue arises from an improper authorization check on the protectMediaLibrary function, allowing unauthenticated attackers to access password-protected files. This enables unauthorized data access, specifically permitting attackers to download files that should be restricted.

Recommendations For versions up to, and including, 3.2.89, update to a version higher than 3.2.89 to resolve the issue. As a temporary workaround, consider disabling the protectMediaLibrary function until a patch is available.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

CWE-289

Related Identifiers

CVE-2024-2098

Affected Products

Download Manager

References · 6

• https://osv.dev/vulnerability/CVE-2024-2098 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-2098 · Security Note
• https://plugins.trac.wordpress.org/changeset/3072712/download-manager · Patch
• https://t.me/cvenotify/83099 · Telegram Post
• https://wordfence.com/threat-intel/vulnerabilities/id/1301c8af-d81a-40f1-96fa-e8252309d8a4?source=cve · Note
• https://t.me/cvenotify/114296 · Telegram Post