CVE-2024-11740
CVSS 3.1 Score 7.3 of 10 (high)
Details
Published Dec 19, 2024
CWE ID 94
Summary
CVE-2024-11740 is a vulnerability affecting the Download Manager plugin for WordPress. The issue allows unauthenticated attackers to execute arbitrary shortcodes due to the plugin's failure to properly validate user input before running do_shortcode. This vulnerability can result in code injection and potential takeover of the WordPress site. Versions up to and including 3.3.03 are impacted. Users are strongly encouraged to update to the latest version of the plugin to mitigate this risk.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.