CVE-2021-25087 Wordpress Download Manager < 3.2.25 - Sensitive Information Disclosure

2022-03-0708:16:18

CWE-862

WPScan

www.cve.org

0.002 Low

EPSS

Percentile

57.8%

JSON

The Download Manager WordPress plugin before 3.2.35 does not have any authorisation checks in some of the REST API endpoints, allowing unauthenticated attackers to call them, which could lead to sensitive information disclosure, such as posts passwords (fixed in 3.2.24) and files Master Keys (fixed in 3.2.25).

CNA Affected

[
  {
    "product": "Download Manager",
    "vendor": "Unknown",
    "versions": [
      {
        "lessThan": "3.2.35",
        "status": "affected",
        "version": "3.2.35",
        "versionType": "custom"
      }
    ]
  }
]

References

wpscan.com/vulnerability/d7ceafae-65ec-4e05-9ed1-59470771bf07

0.002 Low

EPSS

Percentile

57.8%

JSON

Related for CVELIST:CVE-2021-25087