WordPress Download Manager < 3.3.07 - Unauthenticated Data Exposure

mediumseverity

5.3CVSS score

0.5%likelihood of exploitation, next 30 days

42%of all CVEs are less likely

Readycheck to confirm it

The WordPress Download Manager plugin before version 3.3.07 does not prevent directory listing on web servers that don't use htaccess, allowing unauthorized access to files stored in the download-manager-files directory.

Impact

Unauthenticated attackers can access sensitive files stored in the download-manager-files directory due to directory listing, potentially exposing confidential documents or data.

Fix

Update the WordPress Download Manager plugin to version 3.3.07 or later.

How to confirm it

Send: GET {{BaseURL}}/wp-content/uploads/download-manager-files/
Positive when: contains "Index of /wp-content/uploads/download-" and "Last modified" AND status 200

Run it with nuclei: nuclei -id CVE-2024-13126 -u <target>

The full check

id: CVE-2024-13126

info:
  name: WordPress Download Manager < 3.3.07 - Unauthenticated Data Exposure
  author: ritikchaddha
  severity: medium
  description: |
    The WordPress Download Manager plugin before version 3.3.07 does not prevent directory listing on web servers that don't use htaccess, allowing unauthorized access to files stored in the download-manager-files directory.
  impact: |
    Unauthenticated attackers can access sensitive files stored in the download-manager-files directory due to directory listing, potentially exposing confidential documents or data.
  remediation: |
    Update the WordPress Download Manager plugin to version 3.3.07 or later.
  reference:
    - https://wpscan.com/vulnerability/c2c69a44-4ecc-41d1-a10c-cfe9c875b803/
    - https://research.cleantalk.org/cve-2024-13126/
    - https://nvd.nist.gov/vuln/detail/CVE-2024-13126
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
    cvss-score: 5.3
    cve-id: CVE-2024-13126
    cwe-id: CWE-552
    epss-score: 0.00482
    epss-percentile: 0.41916
  metadata:
    verified: true
    max-request: 1
    fofa-query: body="wp-content/plugins/download-manager/"
    google-query: inurl:"/wp-content/plugins/download-manager/"
    shodan-query: html:"wp-content/plugins/download-manager/"
  tags: cve,cve2024,wp,wordpress,wp-plugin,directory-listing,download-manager,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/wp-content/uploads/download-manager-files/"

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "Index of /wp-content/uploads/download-"
          - "Last modified"
        condition: and
        case-insensitive: true

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from