HIGH🇬🇧 English

CVE-2024-11740

CVSS 7.3v3.1pub. 2024-12-19upd. 2025-03-21

The The Download Manager plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 3.3.03. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.

oryginał EN
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

  • W3eden Download Manager

    APP
    W3Eden
    < 3.3.04
🔵
ZWERYFIKUJ U PRODUCENTA
Brak jednoznacznych danych o patchu. Sprawdź referencje od producenta.
Tagi
RCEAuth Bypass
CWE
Referencje

Powiązane podatności

CVE-2024-2098HIGH7.5ten sam produkt

The Download Manager plugin for WordPress is vulnerable to unauthorized access of data due to an improper auth...

CVE-2023-6421HIGH7.5ten sam produkt

The Download Manager WordPress plugin before 3.2.83 does not protect file download's passwords, leaking it upo...

CVE-2023-1809HIGH7.5ten sam produkt

The Download Manager WordPress plugin before 6.3.0 leaks master key information without the need for a passwor...

CVE-2022-2431HIGH8.1ten sam produkt

The Download Manager plugin for WordPress is vulnerable to arbitrary file deletion in versions up to, and incl...

CVE-2022-2436HIGH8.8ten sam produkt

The Download Manager plugin for WordPress is vulnerable to deserialization of untrusted input via the 'file[pa...