CVE-2024-1231
CM Download and File Manager < 2.9.0 - Download Unpublish via CSRF
MEDIUM 6.8EPSS 0.2%
The CM Download Manager WordPress plugin before 2.9.0 does not have CSRF checks in some places, which could allow attackers to make logged in admins unpublish downloads via a CSRF attack
- Affected
- CM Download Manager
- CVSS v3.1 CNA
- 6.8 MEDIUM
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L - EPSS
- 0.22% chance of exploitation in the next 30 days, 12th percentile
- Published
- 2024-03-25
- Updated
- 2025-03-19