CyberRota Analysis
AI-GeneratedThe wp-downloadmanager plugin for WordPress versions 1.68.11 and 6.9.4 is vulnerable due to inadequate file upload validation, allowing admin users to upload arbitrary files without any checks on file type or path sanitization. This flaw can lead to remote code execution, as malicious PHP files can be uploaded and executed from a web-accessible directory. WordPress administrators using these versions should prioritize immediate updates to version 1.69 or later to mitigate this critical security risk.
Original NVD Description
The wp-downloadmanager WordPress plugin, in version 1.68.11 (also affecting the 6.9.4 release line), allows an admin-privileged user (current_user_can('manage_downloads')) to upload arbitrary files via download-add.php with no extension or MIME-type validation of any kind - no wp_check_filetype_and_ext, no validate_file, and no extension blocklist exist anywhere in the upload handler.