CVE-2020-24146
📋 TL;DR
This vulnerability allows authorized WordPress users to perform directory traversal attacks via the CM Download Manager plugin, enabling them to delete arbitrary files on the server. This can lead to denial of service by deleting critical system files. Only WordPress sites running the vulnerable plugin version are affected.
💻 Affected Systems
- CM Download Manager WordPress Plugin
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise through deletion of critical operating system files, leading to permanent data loss and extended service downtime.
Likely Case
Unauthorized deletion of WordPress files causing website malfunction, data loss, and temporary denial of service.
If Mitigated
Limited impact with proper file permissions and monitoring, potentially only affecting non-critical files within the web directory.
🎯 Exploit Status
Exploitation requires authenticated WordPress user access; directory traversal via fileName parameter is straightforward.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.7.1 or later
Vendor Advisory: https://wordpress.org/plugins/cm-download-manager/#developers
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins > Installed Plugins. 3. Find CM Download Manager. 4. Click 'Update Now' if available. 5. Alternatively, download latest version from WordPress repository and manually update.
🔧 Temporary Workarounds
Disable Plugin
allTemporarily disable the vulnerable plugin until patched.
wp plugin deactivate cm-download-manager
Restrict User Permissions
allLimit WordPress user roles that can access plugin functionality.
🧯 If You Can't Patch
- Implement strict file permission controls on web server directories
- Deploy web application firewall rules to block directory traversal patterns
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin panel > Plugins > CM Download Manager version; if version is 2.7.0, system is vulnerable.Check Version:
wp plugin get cm-download-manager --field=versionVerify Fix Applied:
Confirm plugin version is 2.7.1 or higher in WordPress admin panel.📡 Detection & Monitoring
Log Indicators:
- HTTP requests containing 'deletescreenshot' action with '../' sequences in parameters
- Unexpected file deletion events in system logs
Network Indicators:
- POST requests to /wp-admin/admin-ajax.php with fileName parameter containing path traversal sequences
SIEM Query:
source="web_logs" AND uri_path="/wp-admin/admin-ajax.php" AND (param="fileName" AND value="*../*")