CVE-2021-25087 Bypass file protection mechanisms Download Manager Wordpress plugin

1. Vulnerability Properties

Title: Bypass file protection mechanisms Wordpress Download Manager plugin
CVE ID: CVE-2021-25087
CVSSv3 Base Score: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Vendor: W3 Eden, Inc
Products: Wordpress Download Manager plugin
Advisory Release Date: 22-07-2022
Advisory URL: https://labs.integrity.pt/advisories/cve-2021-25087
Credits: Discovery by Diogo Real <dr[at]integrity.pt>

2. Vulnerability Summary

Due to a vulnerability of information disclosure and improper input validation is it possible for an unauthenticated attacker to bypass files protected by password, or roles restrictions mechanisms. It is also possible to obtain Wordpress Posts passwords.

3. Vulnerable Versions

• < 3.2.35

4. Solution

• Update to version 3.2.35 or higher

5. Vulnerability Timeline

• 6/Dec/21  - Bug reported
• 7/Dec/21 - Bug verified
• 25/Jul/22 - Advisory released

6. References

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-25087
• https://wpscan.com/vulnerability/d7ceafae-65ec-4e05-9ed1-59470771bf07