CVE-2024-11740

published 2024-12-19

CVE-2024-11740: The The Download Manager plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 3.3.03. This is due to the…

Priority P1 78 high 7.3 CVSS 3.1

AV N AC L PR N UI N S U C L I L A L

ITW EXPLOIT VulnCheck KEV

The The Download Manager plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 3.3.03. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
codename065	download_manager	<= 3.3.03	—
w3eden	download_manager	< 3.3.04	3.3.04

Detection & IOCs extracted from sources · hover to see the quote

url /?__wpdmxp=%27][/wpdm_package][wpdm_all_packages][wpdm_package%20id=%27↗

path /wp-content/plugins/download-manager/↗

• → Look for GET requests containing the `__wpdmxp` parameter with shortcode injection payload targeting the Download Manager plugin. ↗
• → Successful exploitation returns the string `wpdm-all-packages` and `wpdm-download-link download-on-click` in the HTTP response body. ↗
• → The vulnerable code path is in the plugin's Hooks.php (line 42) and shortcode-iframe.php (line 203), where `do_shortcode` is called without proper input validation. ↗
• → Unauthenticated requests (no authentication required) exploiting this vulnerability; no session cookie or nonce needed. ↗

• · Affected versions are Download Manager plugin <= 3.3.03; version 3.3.04 and later are patched. Detections should be scoped to sites running vulnerable versions. ↗
• · The Nuclei template uses a single HTTP request (max-request: 1), meaning detection is lightweight but relies on specific response body strings that may vary with theme/plugin configuration. ↗

CVSS provenance

nvd v3.1 7.3 HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

vulncheck 7.3 HIGH

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-94