Unauthorized Access of Data in Download Plugin for WordPress

CVE-2024-9829

What is CVE-2024-9829?

The Download Plugin for WordPress is susceptible to unauthorized data access due to inadequate capability checks within the 'dpwap_handle_download_user' and 'dpwap_handle_download_comment' functions. This flaw affects all versions up to and including 2.2.0. Authenticated attackers with Subscriber-level access or higher can exploit this vulnerability to access and download any comment within the platform. Furthermore, they may retrieve metadata containing personally identifiable information (PII) such as usernames, email addresses, hashed passwords, application passwords, and session tokens, thereby posing a serious risk to user privacy and data integrity.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References