VULNERABILITY INTELLIGENCE

CVE-2024-11768

CVSS score5.3 MEDIUM

EPSS probability0.35%

CISA KEVNot currently listed

Published2024-12-19

Last modified2026-06-17

Description

The Download Manager plugin for WordPress is vulnerable to unauthorized download of password-protected content due to improper password validation on the checkFilePassword function in all versions up to, and including, 3.3.03. This makes it possible for unauthenticated attackers to download password-protected files.