CVE-2021-31567 WordPress Download Monitor plugin <= 4.4.6 - Authenticated Arbitrary File Download vulnerability

What is CVE-2021-31567?

CVE-2021-31567 is a medium-severity path traversal vulnerability in n/a, published on 28 Jan 2022. An attacker needs administrator access to exploit it, with no action from the victim.

Official description

Authenticated (admin+) Arbitrary File Download vulnerability discovered in Download Monitor WordPress plugin (versions <= 4.4.6). The plugin allows arbitrary files, including sensitive configuration files such as wp-config.php, to be downloaded via the &downloadable_file_urls[0] parameter data. It's also possible to escape from the web server home directory and download any file within the OS.

Weakness: CWE-200

Which versions are affected by CVE-2021-31567?

It affects 1 product.

Products include Wpchill Download Monitor.

How do I fix CVE-2021-31567?

No fix has been published for CVE-2021-31567 yet. Limit exposure of the affected software until one is available.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2021-31567 being exploited?

There is no known exploitation of CVE-2021-31567 in the wild and no public exploit code.

Other vulnerabilities in n/a

• CVE-2023-34007 WordPress Download Monitor Plugin <= 4.8.3 is vulnerable to Arbitrary File Upload Critical 9.9
• CVE-2024-30501 WordPress Download Monitor theme <= 4.9.4 - Auth. SQL Injection vulnerability High 7.6
• CVE-2022-4972 Download Monitor <= 4.7.51 - Missing Authorization to Unauthenticated Data Export High 7.5
• CVE-2021-24786 Download Monitor < 4.4.5 - Admin+ SQL Injection High 7.2
• CVE-2022-45354 WordPress Download Monitor Plugin <= 4.7.60 is vulnerable to Sensitive Data Exposure Medium 5.3

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-7q5c-gm5x-mj54.