WordPress Plugin Vulnerabilities

Download Monitor < 1.6.4 - Authenticated Directory Listing

Description

Directory listing vulnerability that can lead to information disclosure. Authenticated users can list sever side files and directories.

Proof of Concept

Affects Plugins

Plugin icon
download-monitor
Fixed in 1.6.4

References

URL
https://web.archive.org/web/20150626191631/https://research.evex.pw/?vuln=7

Miscellaneous

Submitter
Abdallah Samman
Submitter twitter
Evex_1337
Verified
No
WPVDB ID
a84882a0-5b18-49dd-9be3-a1d92045d5a9

Timeline

Publicly Published
2015-03-08 (about 11 years ago)
Added
2015-03-09 (about 11 years ago)
Last Updated
2021-10-06 (about 4 years ago)

Other

Published
Title
Published
2014-09-19
Title
Last.fm Rotation 1.0 - lastfm-proxy.php snode Parameter Remote Path Traversal File Access
Published
2024-06-06
Title
Contact Form Builder, Contact Widget <= 2.1.7 - Authentication Request Bypass
Published
2014-11-24
Title
DukaPress <= 2.5.3 - Unauthenticated Path Traversal
Published
2020-08-21
Title
Contact Form - Form builder by Kali Forms < 2.1.2 - Multiple CSRF Bypass Issues
Published
2023-03-06
Title
Formidable Forms < 6.1 - IP Spoofing