CVE-2022-0828

The Download Manager WordPress plugin before 3.2.34 uses the uniqid php function to generate the master key for a download, allowing an attacker to brute force the key with reasonable resources giving direct download access regardless of role based restrictions or password protections set for the...

CVE-2022-0828 Download Manager < 3.2.39 - Unauthenticated brute force of files master key

The Download Manager WordPress plugin before 3.2.34 uses the uniqid php function to generate the master key for a download, allowing an attacker to brute force the key with reasonable resources giving direct download access regardless of role based restrictions or password protections set for the...

CVE-2022-0828

CVE-2022-0828 affects the WordPress Download Manager plugin, with versions prior to 3.2.34 (and related advisories citing up to 3.2.39) susceptible due to a vulnerable master-key generation method. The plugin uses the PHP uniqid function to generate the download master key, enabling an attacker t...