CVE-2021-24698

Simple Download Monitor < 3.9.6 - Arbitrary Thumbnails Removal

The Simple Download Monitor WordPress plugin before 3.9.6 allows users with a role as low as Contributor to remove thumbnails from downloads they do not own, even if they cannot normally edit the download.

Affected

Simple Download Monitor

CVSS v3.1 NVD

4.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

CVSS v2.0 NVD

4.0 MEDIUMAV:N/AC:L/Au:S/C:N/I:P/A:N

EPSS

0.68% chance of exploitation in the next 30 days, 51st percentile

Published

2021-11-08

Updated

2024-08-03

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/1fda1356-77d8-4e77-9ee6-8f9ceeb3d380

References

• CVE Record
• NVD entry