WordPress Plug-in Vulnerability affects 1 lakh sites

The Wordfence Threat Intelligence team has discovered a vulnerability in pouluar plugin Download Manager, installed on over 100,000 sites.

Download Manager, designed to allow site content creators to share downloadable files that are stored as posts. These downloads can be displayed on the front-end of the WordPress site for users to download.

Vulnerable versions allows an authenticated attacker to delete arbitrary files hosted on the server, provided they have access to create downloads. If an attacker deletes the wp-config.php file they can gain administrative privileges, including the ability to execute code, by re-running the WordPress install process.

The vulnerable versions of the plugin register the deleteFiles() function that is called via the before_delete_post hook. This hook is triggered right before a post has been deleted and its intended functionality in this case is to delete any files that may have been uploaded and associated with a download post.

Wordfence Premium, Wordfence Care, and Wordfence Response received a firewall rule on July 8, 2022 to provide protection against any attackers that try to exploit this vulnerability. Wordfence Free users will receive this same protection 30 days later on August 7, 2022.

To stay safe its recommend to ensure that your site has been updated to the latest patched version of Download Manager, which is version 3.2.53 at the time of this publication.

Vulnerability details: