CVE-2021-34639 — WordPress Download Manager <= 3.1.24 Authenticated Arbitrary File Upload
Authenticated File Upload in WordPress Download Manager <= 3.1.24 allows authenticated (Author+) users to upload files with a double extension, e.g. "payload.php.png" which is e…
Published: 2021-08-05 · CVSS: 7.5 · CVSS 3.1
Authenticated File Upload in WordPress Download Manager <= 3.1.24 allows authenticated (Author+) users to upload files with a double extension, e.g. "payload.php.png" which is executable in some configurations. This issue affects: WordPress Download Manager version 3.1.24 and prior versions.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7