Unprotected CSRF Vulnerability in CM Download Manager WordPress Plugin
CVE-2024-1231

Currently unrated

Key Information:

Vendor
Wordpress
Status
Cm Download Manager
Vendor
CVE Published:
25 March 2024

Badges

👾 Exploit Exists🟡 Public PoC

Summary

The CM Download Manager plugin for WordPress prior to version 2.9.0 is vulnerable to Cross-Site Request Forgery, allowing malicious actors to exploit the lack of CSRF checks. This vulnerability can enable attackers to perform actions on behalf of logged-in administrators, such as unpublishing downloads. Such exploits pose significant risks to site integrity and user trust, especially if sensitive files are involved.

Affected Version(s)

CM Download Manager 0 < 2.9.0

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2024-1231 - Proof of Concept

References

https://wpscan.com/vulnerability/7d3968d9-61ed-4c00-8764-...
exploitvdb-entrytechnical-description

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Sushmita Poudel
WPScan
.