CVE-2014-9260

published 2017-08-07

CVE-2014-9260: The basic_settings function in the download manager plugin for WordPress before 2.7.3 allows remote authenticated users to update every WordPress option.

Priority P2 61 high 8.8 CVSS 3.1

AV N AC L PR L UI N S U C H I H A H

EXPLOIT

The basic_settings function in the download manager plugin for WordPress before 2.7.3 allows remote authenticated users to update every WordPress option.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
w3eden	download_manager	< 2.7.3	2.7.3

Detection & IOCs extracted from sources · hover to see the quote

url wp-login.php?action=register↗

• → Look for POST requests containing the parameter 'task=wdm_save_settings' targeting the WordPress Download Manager plugin endpoint, which triggers the vulnerable basic_settings() function allowing arbitrary option updates. ↗
• → Monitor for POST requests that include WordPress core option keys (e.g., 'default_role') being submitted by non-admin authenticated users, as the exploit iterates over all POST parameters and calls update_option() on each. ↗
• → Alert on newly registered users immediately receiving administrator-level privileges, which is the end-state of a successful exploitation of this privilege escalation. ↗

• · The vulnerability affects WordPress Download Manager versions before 2.7.3; any authenticated (including subscriber-level) user can exploit it — not just privileged roles. ↗
• · The vulnerable function is basic_settings() in the Download Manager plugin; the fix was introduced in version 2.7.3. ↗

CVSS provenance

nvd v3.1 8.8 HIGH CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

nvd v2.0 6.5 MEDIUM AV:N/AC:L/Au:S/C:P/I:P/A:P

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.