WordPress Plugin Vulnerabilities

Download Manager < 3.2.49 - Clear Stats & Cache via CSRF

Description

The plugin does not have CSRF check in place in some of its action (such as clear cache and stats as well as update template status), which could allow attackers to make a logged in admin call them via CSRF attacks

Affects Plugins

Plugin icon
download-manager
Fixed in 3.2.49

References

CVE
CVE-2022-34347

Classification

Type
CSRF
OWASP top 10
A2: Broken Authentication and Session Management
CWE
CWE-352
CVSS
4.3 (medium)

Miscellaneous

Original Researcher
Muhammad Daffa
Verified
No
WPVDB ID
1fe07196-52d4-40c5-b01d-69852b4fb9c5

Timeline

Publicly Published
2022-08-02 (about 3 years ago)
Added
2022-08-22 (about 3 years ago)
Last Updated
2023-05-12 (about 3 years ago)

Other

Published
Title
Published
2023-02-14
Title
NextGEN Gallery < 3.29 - Thumbnail Deletion via CSRF
Published
2025-01-16
Title
Hack me if you can <= 1.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Published
2025-06-27
Title
Image Slider With Description <= 9.2 - Cross-Site Request Forgery
Published
2023-03-10
Title
Redirection < 1.1.4 - Redirect Creation via CSRF
Published
2025-02-27
Title
Cardealer < 1.6.5 - Cross-Site Request Forgery to User Update via update_user_profile