WP-DownloadManager, CVE-2020-24141

CVE, Research URL: CVE-2020-24141
Home page URL: Security reports for WP-DownloadManager
Application: WP-DownloadManager
Published on: Jul 07, 2021
Research Description: Server-side request forgery in the WP-DownloadManager plugin 1.68.4 for WordPress lets an attacker send crafted requests from the back-end server of a vulnerable web application via the file_remote parameter to download-add.php. It can help identify open ports, local network hosts and execute command on services
Affected versions: max 1.68.6.
Status: vulnerable