HIGH🇵🇱 Wersja polska

CVE-2024-11740

CVSS 7.3v3.1pub. 2024-12-19upd. 2025-03-21

The The Download Manager plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 3.3.03. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

  • W3eden Download Manager

    APP
    W3Eden
    < 3.3.04
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
RCEAuth Bypass
CWE
References

Related vulnerabilities

CVE-2024-2098HIGH7.5ten sam produkt

The Download Manager plugin for WordPress is vulnerable to unauthorized access of data due to an improper auth...

CVE-2023-6421HIGH7.5ten sam produkt

The Download Manager WordPress plugin before 3.2.83 does not protect file download's passwords, leaking it upo...

CVE-2023-1809HIGH7.5ten sam produkt

The Download Manager WordPress plugin before 6.3.0 leaks master key information without the need for a passwor...

CVE-2022-2431HIGH8.1ten sam produkt

The Download Manager plugin for WordPress is vulnerable to arbitrary file deletion in versions up to, and incl...

CVE-2022-2436HIGH8.8ten sam produkt

The Download Manager plugin for WordPress is vulnerable to deserialization of untrusted input via the 'file[pa...