WordPress Download Monitor Plugin < 4.4.7 Multiple Vulnerabilities

The WordPress plugin Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can redistribute it and/or modify it...

CVE-2021-31567

Authenticated admin+ Arbitrary File Download vulnerability discovered in Download Monitor WordPress plugin versions = 4.4.6. The plugin allows arbitrary files, including sensitive configuration files such as wp-config.php, to be downloaded via the &downloadablefileurls0 parameter data. It's also...

CVE-2021-31567

CVE-2021-31567 affects the WordPress plugin Download Monitor (versions ≤ 4.4.6). An authenticated admin+ user can trigger an arbitrary file download via the parameter &downloadable_file_urls[0], enabling access to sensitive files (e.g., wp-config.php) and even escaping the web server home directo...