CVE-2024-2098

—

CVSS 3.1

7.5 high

EPSS

<1%p38

Published

Jun 13, 2024 (Jun 13, 2024)

Modified

Jun 17, 2026

Description

The Download Manager plugin for WordPress is vulnerable to unauthorized access of data due to an improper authorization check on the 'protectMediaLibrary' function in all versions up to, and including, 3.2.89. This makes it possible for unauthenticated attackers to download password-protected files.

Vendors: w3eden
Products: download manager
Ecosystems: WordPress
Weakness: CWE-289, CWE-863
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

NVD CVE.org GitHub PoCs EPSS (0.5%)

In the news0 stories

No ingested article mentions this CVE yet.