CVE-2024-3269: falha de média gravidade em wpchill Download Monitor
Download Monitor <= 4.9.13 - Missing Authorization
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 5.4epss 0.3%
The Download Monitor plugin for WordPress is vulnerable to unauthorized access to functionality due to a missing capability check on the dlm_uninstall_plugin function in all versions up to, and including, 4.9.13. This makes it possible for authenticated attackers to uninstall the plugin and delete its data.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
Produtos afetados
wpchill · Download MonitorCVEs relacionadas — wpchill Download Monitor
No mesmo produto, das mais perigosas para as menos.
CVE-2022-4972HIGHDownload Monitor <= 4.7.51 - Missing Authorization to Unauthenticated Data ExportEPSS 0.5%CVE-2024-10092MEDIUMDownload Monitor <= 5.0.12 - Missing Authorization to API Key ManipulationEPSS 0.5%CVE-2024-10399MEDIUMDownload Monitor <= 5.0.13 - Missing Authorization to Sensitive Information ExposureEPSS 0.4%CVE-2024-8552MEDIUMDownload Monitor <= 5.0.9 - Missing Authorization to Authenticated (Subscriber+) Shop EnableEPSS 0.4%CVE-2026-100182HIGHDownload Monitor <= 5.2.10 - Unauthenticated Stored Cross-Site Scripting via Cross-Origin postMessage to Admin EditorEPSS 0.3%CVE-2026-3124HIGHDownload Monitor <= 5.1.7 - Insecure Direct Object Reference to Unauthenticated Arbitrary Order Completion via 'token' and 'order_id'EPSS 0.3%