CVE-2024-13126
Download Manager < 3.3.07 - Unauthenticated Data Exposure
Vexday Risk Score
28Low
SSVC decision (CISA)
Attend
PoC available → attend closely
CVSS 4.6EPSS 0.5%KEV nãoPoC —Nuclei simMetasploit —Patch —
Lifecycle
16 Mar 2025Published on NVD
Recommendation: Plan a near-term fix — a public PoC already exists.
The Download Manager WordPress plugin before 3.3.07 doesn't prevent directory listing on web servers that don't use htaccess, allowing unauthorized access of files.
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L
Affected products
Unknown · Download Manager