CVE-2024-1231

MediumCVSS 6.8/10Last modified Jun 17, 2026

Description

The CM Download Manager WordPress plugin before 2.9.0 does not have CSRF checks in some places, which could allow attackers to make logged in admins unpublish downloads via a CSRF attack

Metrics

CVSS 3.1 6.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L

Weakness enumeration

CWE-352

Affected software

Vendor	Product	Versions
Unknown	CM Download Manager	< 2.9.0
cminds	cm_download_manager	< 2.9.0

References

https://wpscan.com/vulnerability/7d3968d9-61ed-4c00-8764-0360cf03255e/Exploit, Third Party Advisory
https://wpscan.com/vulnerability/7d3968d9-61ed-4c00-8764-0360cf03255e/Exploit, Third Party Advisory

Timeline

Published: Mar 25, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-123107.0A vulnerability in Imprivata Enterprise Access Management (formerly Imprivata OneSign) allows bypassing the login screen of the shared kiosk CVE-2024-123116.5The Email Subscribers by Icegram Express WordPress plugin before 5.7.44 does not sanitize and escape a parameter before using it in a SQL s CVE-2024-123128.1The Print Science Designer plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.3.152 via dese CVE-2024-123138.1The Compare Products for WooCommerce plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.2.1 CVE-2024-123147.2The Rapid Cache plugin for WordPress is vulnerable to Cache Poisoning in all versions up to, and including, 1.2.3. This is due to plugin sto CVE-2024-123157.5The Export All Posts, Products, Orders, Refunds & Users plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions CVE-2024-123165.3The Jupiter X Core plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the export_popup_a CVE-2024-12324.8The CM Download Manager WordPress plugin before 2.9.0 does not have CSRF checks in some places, which could allow attackers to make logged CVE-2024-123206.1The Team Rosters plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘tab’ parameter in all versions up to, and inc CVE-2024-123217.1The WC Affiliate WordPress plugin through 2.3.9 does not sanitise and escape a parameter before outputting it back in the page, leading to CVE-2024-123228.8The ThePerfectWedding.nl Widget plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.8. CVE-2024-123236.1The turboSMTP plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘page’ parameter in all versions up to, and inclu