Threats tagged 'ghsa-q45h-66c4-7wxq'

The Download Manager WordPress plugin versions before 3.3.73 and before 7.6.2 contain a vulnerability where the plugin does not verify a package's configured role restriction when validating a package password. This flaw allows an unauthenticated user who knows the password of a role-restricted package to obtain a download key and download the protected file.