CVE-2020-24146

Directory traversal in the CM Download Manager (aka cm-download-manager) plugin 2.7.0 for WordPress allows authorized users to delete arbitrary files and possibly cause a denial of service via the fileName parameter in a deletescreenshot action.

• CWE-22

• https://github.com/secwx/research/blob/main/cve/CVE-2020-24146.mdThird Party Advisory
• https://wordpress.org/plugins/cm-download-manager/#developersRelease Notes, Vendor Advisory
• https://github.com/secwx/research/blob/main/cve/CVE-2020-24146.mdThird Party Advisory
• https://wordpress.org/plugins/cm-download-manager/#developersRelease Notes, Vendor Advisory

Published

Jul 7, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-24140Server-side request forgery in Wcms 0.3.2 let an attacker se…8.3
• CVE-2020-24141Server-side request forgery in the WP-DownloadManager plugin…5.3
• CVE-2020-24142Server-side request forgery in the Video Downloader for TikT…9.8
• CVE-2020-24143Directory traversal in the Video Downloader for TikTok (aka …7.5
• CVE-2020-24144Directory traversal in the Media File Organizer (aka media-f…8.6
• CVE-2020-24145Cross Site Scripting (XSS) vulnerability in the CM Download …6.1
• CVE-2020-24147Server-side request forgery (SSR) vulnerability in the WP Sm…9.1
• CVE-2020-24148Server-side request forgery (SSRF) in the Import XML and RSS…9.1
• CVE-2020-24149Server-side request forgery (SSRF) in the Podcast Importer S…7.5
• CVE-2020-24158360 Speed Browser 12.0.1247.0 has a DLL hijacking vulnerabil…7.8
• CVE-2020-24159NetEase Youdao Dictionary has a DLL hijacking vulnerability,…7.8
• CVE-2020-24160Shenzhen Tencent TIM Windows client 3.0.0.21315 has a DLL hi…7.8