Skip to content
Sign in
Not rated

CVE-2021-24703 The Download Plugin WordPress plugin before 1.6.1 does not have capability and CSRF checks in the…

Description

The Download Plugin WordPress plugin before 1.6.1 does not have capability and CSRF checks in the dpwap_plugin_activate AJAX action, allowing any authenticated users, such as subscribers, to activate plugins that are already installed.

Affected products and versions

Product Affected versions Fixed in
Download Plugin 1.6 earliest → < 1.6.1 1.6.1

Other CVEs of Download Plugin

The 2 CVEs of Download Plugin →
CVE-2021-25059 The Download Plugin WordPress plugin before 2.0.0 does not properly validate a user has the required privileges to… 5.4 Medium
Track this CVE