CVE-2021-25087CWE-862

Wordpress Download Manager < 3.2.25 - Sensitive Information Disclosure

published March 7, 2022

CVSS
—
EPSS
2%
Percentile
74.3
In the wild
Unconfirmed
What it is

The Download Manager WordPress plugin before 3.2.35 does not have any authorisation checks in some of the REST API endpoints, allowing unauthenticated attackers to call them, which could lead to sensitive information disclosure, such as posts passwords (fixed in 3.2.24) and files Master Keys (fixed in 3.2.25).

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01516 · 74.3th percentile
Weakness
CWE-862 · Missing Authorization
Published
2022-03-07T08:16Z
EPSS history
Timeline
  • 07 MAR 08:16Z
    Wordpress Download Manager < 3.2.25 - Sensitive Information Disclosure
    cvelistv5