CVE-2022-2431

The Download Manager plugin for WordPress is vulnerable to arbitrary file deletion in versions up to, and including 3.2.50. This is due to insufficient file type and path validation on the deleteFiles() function found in the ~/Admin/Menu/Packages.php file that triggers upon download post deletion. This makes it possible for contributor level users and above to supply an arbitrary file path via the 'file[files]' parameter when creating a download post and once the user deletes the post the supplied arbitrary file will be deleted. This can be used by attackers to delete the /wp-config.php file which will reset the installation and make it possible for an attacker to achieve remote code execution on the server.

• CWE-73
• CWE-610

• https://packetstormsecurity.com/files/167920/wpdownloadmanager3250-filedelete.txtThird Party Advisory, VDB Entry
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2762092%40download-manager&new=2762092%40download-manager&sfp_email=&sfph_mail=Patch, Third Party Advisory
• https://www.wordfence.com/blog/2022/08/high-severity-vulnerability-patched-in-download-manager-plugin/Exploit, Third Party Advisory
• https://packetstormsecurity.com/files/167920/wpdownloadmanager3250-filedelete.txtThird Party Advisory, VDB Entry
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2762092%40download-manager&new=2762092%40download-manager&sfp_email=&sfph_mail=Patch, Third Party Advisory
• https://www.wordfence.com/blog/2022/08/high-severity-vulnerability-patched-in-download-manager-plugin/Exploit, Third Party Advisory

Published

Sep 6, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-24304Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2022-24305Zoho ManageEngine SharePoint Manager Plus before 4329 is vul…9.8
• CVE-2022-24306Zoho ManageEngine SharePoint Manager Plus before 4329 allows…9.8
• CVE-2022-24307Mastodon before 3.3.2 and 3.4.x before 3.4.6 has incorrect a…9.8
• CVE-2022-24308Automox Agent prior to version 37 on Windows and Linux and V…5.5
• CVE-2022-24309A vulnerability has been identified in Mendix Runtime V7 (Al…8.1
• CVE-2022-24310A CWE-190: Integer Overflow or Wraparound vulnerability exis…9.8
• CVE-2022-24311A CWE-22: Improper Limitation of a Pathname to a Restricted …9.8
• CVE-2022-24312A CWE-22: Improper Limitation of a Pathname to a Restricted …9.8
• CVE-2022-24313A CWE-120: Buffer Copy without Checking Size of Input vulner…9.8
• CVE-2022-24314A CWE-125: Out-of-bounds Read vulnerability exists that coul…7.5
• CVE-2022-24315A CWE-125: Out-of-bounds Read vulnerability exists that coul…7.5