CVE-2020-24141

Server-side request forgery in the WP-DownloadManager plugin 1.68.4 for WordPress lets an attacker send crafted requests from the back-end server of a…

published July 7, 2021

CVSS
—
EPSS
1%
Percentile
60.4
In the wild
Unconfirmed
What it is

Server-side request forgery in the WP-DownloadManager plugin 1.68.4 for WordPress lets an attacker send crafted requests from the back-end server of a vulnerable web application via the file_remote parameter to download-add.php. It can help identify open ports, local network hosts and execute command on services

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00933 · 60.4th percentile
Published
2021-07-07T13:34Z
EPSS history
Timeline
  • 07 JUL 13:34Z
    Server-side request forgery in the WP-DownloadManager plugin 1.68.4 for WordPress lets an attacker send crafted requests from the back-end server of a…
    cvelistv5