CVE-2022-4972: Download Monitor <= 4.7.51 - Missing Authorization to Unauthenticated Data Export
First published: Wed Oct 16 2024(Updated: )
The Download Monitor plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on several REST-API routes related to reporting in versions up to, and including, 4.7.51. This makes it possible for unauthenticated attackers to view user data and other sensitive information intended for administrators.
Credit: security@wordfence.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| WPChill Download Monitor | <=4.7.51 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://www.wordfence.com/threat-intel/vulnerabilities/id/a9000c52-fdd7-43e2-ae6a-9f127c4a9fcd?source=cve
- https://plugins.trac.wordpress.org/changeset/2822758/download-monitor/trunk/src/Admin/Reports/class-dlm-reports.php?contextall=1&old=2821522&old_path=%2Fdownload-monitor%2Ftrunk%2Fsrc%2FAdmin%2FReports%2Fclass-dlm-reports.php
Frequently Asked Questions
What is the severity of CVE-2022-4972?
CVE-2022-4972 is assigned a moderate severity level due to the potential for unauthorized access to user data.
How do I fix CVE-2022-4972?
To fix CVE-2022-4972, update the Download Monitor plugin to version 4.7.52 or later.
Who is affected by CVE-2022-4972?
Any user running version 4.7.51 or earlier of the Download Monitor plugin for WordPress is affected by CVE-2022-4972.
What vulnerabilities come with CVE-2022-4972?
CVE-2022-4972 allows unauthenticated attackers to bypass authorization and access sensitive user data.
Is there a workaround for CVE-2022-4972?
A temporary workaround for CVE-2022-4972 is to disable the Download Monitor plugin until an update is applied.
- agent/weakness
- agent/title
- agent/references
- agent/description
- agent/first-publish-date
- agent/type
- agent/severity
- agent/author
- agent/event
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/softwarecombine
- agent/source
- agent/tags
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/wpchill
- canonical/wpchill download monitor
- version/wpchill download monitor/4.7.51