Download Monitor, 7a142941e5d14e8bc2a1b469281c9ada144d4cc9

CVE, Research URL: 7a142941e5d14e8bc2a1b469281c9ada144d4cc9
Home page URL: Security reports for Download Monitor
Application: Download Monitor
Published on: Jun 07, 2023
Research Description: Download Monitor [download-monitor] < 4.8.4 Download Monitor <= 4.8.3 - Authenticated(Subscriber+) Arbitrary File Upload via upload_file The Download Monitor plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation and access controls on the 'upload_file' function in versions up to, and including, 4.8.3. This makes it possible for authenticated attackers with subscriber-level capabilities or above to upload arbitrary files on the affected site's server which may make remote code execution possible.
Affected versions: max 4.8.4.
Status: vulnerable