CVE-2022-0828
📋 TL;DR
This vulnerability in the Download Manager WordPress plugin allows attackers to brute-force download access keys, bypassing role-based restrictions and password protections. Any WordPress site using affected versions of this plugin is vulnerable, potentially exposing sensitive files to unauthorized users.
💻 Affected Systems
- WordPress Download Manager plugin
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Unauthorized access to all protected downloads including sensitive files, intellectual property, or confidential documents regardless of access controls.
Likely Case
Exposure of some protected downloads to attackers who invest minimal resources in brute-forcing keys.
If Mitigated
No impact if plugin is patched or disabled, or if downloads are stored outside the web-accessible directory.
🎯 Exploit Status
The vulnerability is straightforward to exploit using automated tools to brute-force the predictable uniqid() generated keys.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.2.34 and later
Vendor Advisory: https://wordpress.org/plugins/download-manager/#developers
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins → Installed Plugins. 3. Find 'Download Manager' and click 'Update Now'. 4. Verify version is 3.2.34 or higher.
🔧 Temporary Workarounds
Disable Download Manager plugin
allTemporarily disable the vulnerable plugin until patching is possible
wp plugin deactivate download-manager
Move protected downloads outside web root
allStore sensitive downloads outside the publicly accessible directory and serve via secure methods
🧯 If You Can't Patch
- Implement web application firewall rules to block download key brute-force attempts
- Monitor access logs for unusual download patterns and implement rate limiting
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin panel → Plugins → Download Manager version. If version is below 3.2.34, the site is vulnerable.Check Version:
wp plugin get download-manager --field=versionVerify Fix Applied:
Confirm Download Manager plugin version is 3.2.34 or higher in WordPress admin panel.📡 Detection & Monitoring
Log Indicators:
- Multiple failed download attempts with sequential or predictable key patterns
- Successful downloads from unusual IP addresses or user agents
Network Indicators:
- High volume of requests to download endpoints with varying key parameters
- Patterns of sequential key guessing in download URLs
SIEM Query:
source="web_logs" AND (url="*wpdmact=*" OR url="*download-manager*download*" OR url="*wpdmact=*download*") AND (status=200 OR status=403) | stats count by src_ip, url