Simple Download Monitor <= 3.2.8 - Missing Authorization
2016-01-19 00:00
James GolovichStrategic Overview
StatusPatched in 3.2.9
Affected PluginSimple Download Monitor
Affected Version
<= 3.2.8CVSS9.9Critical
CVE
N/AVulnerability Overview
The Simple Download Monitor plugin for WordPress is vulnerable to authorization bypass due to missing capability checks on the 'sdm_tiny_get_post_ids_ajax_call()' and 'sdm_remove_thumbnail_image_ajax_call()' functions in versions up to, and including, 3.2.8. This makes it possible for unauthorized attackers to access otherwise private files and delete thumbnails.
Technical Analysis
REMEDIATION: Update to version 3.2.9, or a newer patched version --- IDENTIFIER: CWE-285 (Improper Authorization) The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.
External References
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C