CVE-2022-2362

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

The Download Manager WordPress plugin before 3.2.50 prioritizes getting a visitor's IP from certain HTTP headers over PHP's REMOTE_ADDR, which makes it possible to bypass IP-based download blocking restrictions.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
Unknown	Download Manager	>= 3.2.50, < 3.2.50

References

https://wpscan.com/vulnerability/d94b721e-9ce2-45e5-a673-2a57b0137653Exploit, Third Party Advisory
https://wpscan.com/vulnerability/d94b721e-9ce2-45e5-a673-2a57b0137653Exploit, Third Party Advisory

Timeline

Published: Aug 22, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-236205.4XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions AbstractSxExpo CVE-2022-236214.9XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions any user with CVE-2022-236226.1XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions there is a cro CVE-2022-236238.8Frourio is a full stack framework, for TypeScript. Frourio users who uses frourio version prior to v0.26.0 and integration with class-valida CVE-2022-236248.8Frourio-express is a minimal full stack framework, for TypeScript. Frourio-express users who uses frourio-express version prior to v0.26.0 a CVE-2022-236256.5Wire-ios is a messaging application using the wire protocol on apple's ios platform. In versions prior to 3.95 malformed resource identifier CVE-2022-236268.8m1k1o/blog is a lightweight self-hosted facebook-styled PHP blog. Errors from functions `imagecreatefrom*` and `image*` have not been checke CVE-2022-236276.8ArchiSteamFarm (ASF) is a C# application with primary purpose of idling Steam cards from multiple accounts simultaneously. Due to a bug in A CVE-2022-236285.3OPA is an open source, general-purpose policy engine. Under certain conditions, pretty-printing an abstract syntax tree (AST) that contains CVE-2022-23634.6A vulnerability, which was classified as problematic, has been found in SourceCodester Simple Parking Management System 1.0. Affected by thi CVE-2022-236307.5Gradle is a build tool with a focus on build automation and support for multi-language development. In some cases, Gradle may skip that veri CVE-2022-236319.8superjson is a program to allow JavaScript expressions to be serialized to a superset of JSON. In versions prior to 1.8.1 superjson allows i