CVE-2021-24703: vulnerability in Download Plugin
Download Plugin < 1.6.1 - Subscriber+ Arbitrary Plugin Activation
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
3Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackepss 0.4%
The Download Plugin WordPress plugin before 1.6.1 does not have capability and CSRF checks in the dpwap_plugin_activate AJAX action, allowing any authenticated users, such as subscribers, to activate plugins that are already installed.
Affected products
Unknown · Download PluginRelated CVEs — Download Plugin
In the same product, most dangerous first.