CVE-2021-25087
Wordpress Download Manager < 3.2.25 - Sensitive Information Disclosure
- State
- Published
- Severity
- Not scored
- Published
- Mar 7, 2022
- Updated
- Aug 3, 2024
- Reserved
- Jan 14, 2021
Description
The Download Manager WordPress plugin before 3.2.35 does not have any authorisation checks in some of the REST API endpoints, allowing unauthenticated attackers to call them, which could lead to sensitive information disclosure, such as posts passwords (fixed in 3.2.24) and files Master Keys (fixed in 3.2.25).
Scores
The record has no CVSS score.
Weaknesses
- CWE-862 Missing Authorization
Affected Products
| Product | Versions |
|---|---|
Download ManagerUnknown |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.