high8.8Public exploit code
CVE-2014-9260
The basic_settings function in the download manager plugin for WordPress before 2.7.3 allows remote authenticated users to update every WordPress option.
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- WordPress Plugin Download Manager 2.7.2 - Privilege Escalation2014-11-24 · webapps · php
Impact
The basic_settings function in the download manager plugin for WordPress before 2.7.3 allows remote authenticated users to update every WordPress option.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| W3eden | Download Manager | before 2.7.3 |