CVE-2022-0828

The Download Manager WordPress plugin before 3.2.34 uses the uniqid php function to generate the master key for a download, allowing an attacker to brute force the key with reasonable resources giving direct download access regardless of role based restrictions or password protections set for the download.

The Download Manager WordPress plugin before 3.2.34 uses the uniqid php function to generate the master key for a download, allowing an attacker to brute force the key with reasonable resources giving direct download access regardless of role based restrictions or password protections set for the download.

El plugin Download Manager de WordPress versiones anteriores a 3.2.39, usa la función php uniqid para generar la clave maestra para una descarga, permitiendo a un atacante forzar la clave con recursos razonables dando acceso directo a la descarga independientemente de las restricciones basadas en el rol o las protecciones de contraseña establecidas para la descarga