CVE-2022-3076

PoC —

CVSS 3.1

7.2 high

EPSS

1%p66

Published

Sep 26, 2022 (Sep 26, 2022)

Modified

Jun 17, 2026

Description

The CM Download Manager WordPress plugin before 2.8.6 allows high privilege users such as admin to upload arbitrary files by setting the any extension via the plugin's setting, which could be used by admins of multisite blog to upload PHP files for example.

Vendors: cminds
Products: cm download manager
Ecosystems: WordPress
Weakness: CWE-434
Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (1.2%)

In the news0 stories

No ingested article mentions this CVE yet.