Download Manager, 8bf7dc0b13ac87ac6d84b97aa69a69fa26e9a8c5

CVE, Research URL: 8bf7dc0b13ac87ac6d84b97aa69a69fa26e9a8c5
Home page URL: Security reports for Download Manager
Application: Download Manager
Published on: Mar 01, 2017
Research Description: Download Manager [download-manager] < 2.9.46 WordPress Download Manager <= 2.9.45 - Cross-Site Request Forgery The WordPress Download Manager plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.9.45. This is due to missing or incorrect nonce validation on the request of saving settings. This makes it possible for unauthenticated attackers to modify administrative settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Affected versions: max 2.9.46.
Status: vulnerable