Download Monitor
CVE-2023-34007
CRITICAL
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
1DescriptionCVE.org
Unrestricted Upload of File with Dangerous Type vulnerability in WPChill Download Monitor.This issue affects Download Monitor: from n/a through 4.8.3.
AnalysisAI
Unrestricted Upload of File with Dangerous Type vulnerability in WPChill Download Monitor.8.3. Rated critical severity (CVSS 9.9), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Technical ContextAI
This vulnerability is classified as Unrestricted File Upload (CWE-434), which allows attackers to upload malicious files that can be executed on the server. Unrestricted Upload of File with Dangerous Type vulnerability in WPChill Download Monitor.8.3. Affected products include: Wpchill Download Monitor. Version information: through 4.8.3..
RemediationAI
No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Validate file types server-side, store uploads outside webroot, use random filenames, scan for malware.
More in Download Monitor
View allExposure of Sensitive Information to an Unauthorized Actor vulnerability in WPChill Download Monitor.7.60. Rated medium
Download Monitor WordPress plugin versions before 5.2.6 fails to enforce authorization on an AJAX download-logging endpo
The Download Monitor WordPress plugin before 4.5.98 does not ensure that files to be downloaded are inside the blog fold
The Download Monitor WordPress plugin before 4.5.91 does not ensure that files to be downloaded are inside the blog fold
Cross-site scripting (XSS) vulnerability in the Download Monitor plugin before 3.3.5.9 for WordPress allows remote attac
Blind SQL injection in the WP Chill Download Monitor plugin for WordPress affects all versions from an unspecified early
Cross-site scripting (XSS) vulnerability in admin/admin.php in the Download Monitor plugin before 3.3.6.2 for WordPress
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPChill Download M
Insecure Direct Object Reference in WP Download Monitor plugin (≤5.1.7) enables unauthenticated attackers to complete ar
Reflected/unauthenticated Cross-Site Scripting in the Download Monitor - WPForms Lock add-on for WordPress (versions ≤ 1
Path traversal in the WordPress Download Monitor plugin (versions <= 5.1.9, by WP Chill) allows a network-accessible att
Cross-site scripting (XSS) vulnerability in admin/admin.php in the Download Monitor plugin before 3.3.6.2 for WordPress
Same technique File Upload
View allShare
External POC / Exploit Code
Leaving vuln.today