CVE-2022-2436: Download Manager <= 3.2.49 - Authenticated (Contributor+) PHAR Deserialization
The Download Manager plugin for WordPress is vulnerable to deserialization of untrusted input via the 'file[packagedir]' parameter in versions up to, and including 3.2.49. This makes it possible for authenticated attackers with contributor privileges and above to call files using a PHAR wrapper that will deserialize the data and call arbitrary PHP Objects that can be used to perform a variety of malicious actions granted a POP chain is also present. It also requires that the attacker is successful in uploading a file with the serialized payload.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2022-2436?
CVE-2022-2436 has a medium severity rating allowing authenticated attackers to exploit the deserialization vulnerability.
Who is affected by CVE-2022-2436?
CVE-2022-2436 affects the WordPress Download Manager plugin versions up to and including 3.2.49.
How do I fix CVE-2022-2436?
To fix CVE-2022-2436, update the WordPress Download Manager plugin to version 3.2.50 or higher.
What type of attack does CVE-2022-2436 enable?
CVE-2022-2436 enables authenticated attackers to execute arbitrary code via a PHAR wrapper due to untrusted input deserialization.
What are the requirements for exploiting CVE-2022-2436?
Exploiting CVE-2022-2436 requires authenticated user access with at least contributor privileges.