CVE-2014-9260: High severity download manager vulnerability
Published Aug 7, 2017
·Updated
The basicsettings function in the download manager plugin for WordPress before 2.7.3 allows remote authenticated users to update every WordPress option.
Affected Software
2 affected components
Downloadmanager Download Manager Wordpress<=2.7.2
W3eden Download Manager Wordpress<2.7.3
Event History
Aug 7, 2017
CVE Published
via MITRE·05:00 PM
Data Sourced
via MITRE·05:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2014-9260?
CVE-2014-9260 has a medium severity classification as it allows remote authenticated users to update any WordPress option.
2
How do I fix CVE-2014-9260?
To fix CVE-2014-9260, upgrade the Download Manager plugin to version 2.7.3 or higher.
3
Who is affected by CVE-2014-9260?
CVE-2014-9260 affects users of the Download Manager plugin for WordPress versions prior to 2.7.3.
4
What kind of attack does CVE-2014-9260 allow?
CVE-2014-9260 allows a remote authenticated attacker to perform unauthorized modifications on WordPress options.
5
What are the implications of CVE-2014-9260?
The implications of CVE-2014-9260 include potential privilege escalation leading to unauthorized control over site settings.