← CVE Intelligence

CVE-2021-24703

Download Plugin < 1.6.1 - Subscriber+ Arbitrary Plugin Activation PUBLISHED

Description (CNA)

The Download Plugin WordPress plugin before 1.6.1 does not have capability and CSRF checks in the dpwap_plugin_activate AJAX action, allowing any authenticated users, such as subscribers, to activate plugins that are already installed.

Affected (CNA)

Vendor / productVersions
Unknown / Download Pluginaffected 1.6.1 before 1.6.1

CWE

CWE-732

References

ADP enrichment

CVE

No English description supplied.