CVE-2022-3076 - CM Download Manager < 2.8.6 - Admin+ Arbitrary File Upload

Back Back to CVE browser

HIGH

CM Download Manager < 2.8.6 - Admin+ Arbitrary File Upload

Published Sep 26, 2022

7.2

HIGH

CVSS 3.1

EPSS 1.52%

Description

The CM Download Manager WordPress plugin before 2.8.6 allows high privilege users such as admin to upload arbitrary files by setting the any extension via the plugin's setting, which could be used by admins of multisite blog to upload PHP files for example.

Affected products

Vendor n/a Product CM Download Manager Default
unknown
Affected
- ≥ 2.8.6, < 2.8.6

Default status is the baseline for the product. Each version can override it (patched versions can be marked unaffected).

Vendor	Product	Default status	Versions
n/a	CM Download Manager	unknown	Affected ≥ 2.8.6, < 2.8.6

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-434

Unrestricted Upload of File

References (2)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-42505
Advisory
https://wpscan.com/vulnerability/d18e695b-4d6e-4ff6-a060-312594a0d2bd
x_refsource_MISCExploitPatchThird Party Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-42505		Advisory
https://wpscan.com/vulnerability/d18e695b-4d6e-4ff6-a060-312594a0d2bd		x_refsource_MISCExploitPatchThird Party Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner WPScan

Published Sep 26, 2022

Updated May 22, 2025

Reserved Sep 1, 2022

Link CVE-2022-3076

CISA Vulnrichment

Updated May 22, 2025

NVD

Status Modified

Modified Jun 17, 2026

Link CVE-2022-3076

Red Hat

No data

ENISA EUVD

Assigner WPScan

Published Sep 26, 2022

Updated May 22, 2025

Link EUVD-2022-42505

GitHub

No data