CVE-2024-13126

Download Manager < 3.3.07 - Unauthenticated Data Exposure

The Download Manager WordPress plugin before 3.3.07 doesn't prevent directory listing on web servers that don't use htaccess, allowing unauthorized access of files.

Affected

Download Manager

CVSS v3.1 CNA

4.6 MEDIUMCVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L

EPSS

0.48% chance of exploitation in the next 30 days, 40th percentile

Nuclei

medium · CWE-552

Published

2025-03-16

Updated

2025-03-17

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/c2c69a44-4ecc-41d1-a10c-cfe9c875b803/

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-13126.yaml

Security advisories

• https://wpscan.com/vulnerability/c2c69a44-4ecc-41d1-a10c-cfe9c875b803

References

• CVE Record
• NVD entry