Download Manager, c7624b475fdc9965e4feb7e8aeb5f8eedf454fcc

CVE, Research URL: c7624b475fdc9965e4feb7e8aeb5f8eedf454fcc
Home page URL: Security reports for Download Manager
Application: Download Manager
Published on: Jan 09, 2018
Research Description: Download Manager [download-manager] < 2.9.61 WordPress Download Manager <= 2.9.6 - Cross-Site Request Forgery The WordPress Download Manager plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.9.6. This is due to missing or incorrect nonce validation on the wpdm_install_addon function. This makes it possible for unauthenticated attackers to install malicious plugins and/or packages via forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Affected versions: max 2.9.61.
Status: vulnerable