Threat Entry Updated 2025-04-01

CVE-2024-1962 - Cm Download Manager Plugin

The CM Download Manager WordPress plugin before 2.9.1 does not have CSRF checks in some places, which could allow attackers to make logged in admins edit downloads via a CSRF attack

PLUGIN Cm Download Manager

CVE-2024-1962

HIGH CVSS 8.8 2024-03-25

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2025-04-01

CVE-2024-1231 - Cm Download Manager Plugin

The CM Download Manager WordPress plugin before 2.9.0 does not have CSRF checks in some places, which could allow attackers to make logged in admins unpublish downloads via a CSRF attack

PLUGIN Cm Download Manager

CVE-2024-1231

MEDIUM CVSS 6.8 2024-03-25

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2025-04-01

CVE-2024-1232 - Cm Download Manager Plugin

The CM Download Manager WordPress plugin before 2.9.0 does not have CSRF checks in some places, which could allow attackers to make logged in admins delete downloads via a CSRF attack

PLUGIN Cm Download Manager

CVE-2024-1232

MEDIUM CVSS 4.8 2024-03-25

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2025-05-22

CVE-2022-3076 - Cm Download Manager Plugin

The CM Download Manager WordPress plugin before 2.8.6 allows high privilege users such as admin to upload arbitrary files by setting the any extension via the plugin's setting, which could be used by admins of multisite blog to upload PHP files for example.

PLUGIN Cm Download Manager

CVE-2022-3076

HIGH CVSS 7.2 2022-09-26

Risk Score

Open Full Technical Breakdown