CVE-2022-0828

The Download Manager WordPress plugin before 3.2.34 uses the uniqid php function to generate the master key for a download, allowing an attacker to brute force the key with reasonable resources giving direct download access regardless of role based restrictions or password protections set for the download.

CVSS v3.1

7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CVSS v2.0

5.0 MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N

EPSS

1.53% chance of exploitation in the next 30 days, 73th percentile

Published

2022-04-11

Updated

2024-08-02

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/7f0742ad-6fd7-4258-9e44-d42e138789bb

References

• CVE Record
• NVD entry

Related

• CVE-2022-0827
• CVE-2022-0829
• CVE-2022-0826
• CVE-2022-0830
• CVE-2022-0825
• CVE-2022-0833