CVE-2022-3076 CM Download Manager < 2.8.6 - Admin+ Arbitrary File Upload

2022-09-2612:35:42

CWE-434

WPScan

www.cve.org

cve-2022-3076

cm download manager

wordpress plugin

admin

arbitrary file upload

setting

multisite blog

php files

0.001 Low

EPSS

Percentile

43.1%

JSON

The CM Download Manager WordPress plugin before 2.8.6 allows high privilege users such as admin to upload arbitrary files by setting the any extension via the plugin’s setting, which could be used by admins of multisite blog to upload PHP files for example.

CNA Affected

[
  {
    "product": "CM Download Manager",
    "vendor": "Unknown",
    "versions": [
      {
        "lessThan": "2.8.6",
        "status": "affected",
        "version": "2.8.6",
        "versionType": "custom"
      }
    ]
  }
]

References

wpscan.com/vulnerability/d18e695b-4d6e-4ff6-a060-312594a0d2bd

0.001 Low

EPSS

Percentile

43.1%

JSON

Related for CVELIST:CVE-2022-3076