WordPress Download Manager Plugin Unauthenticated Cron Trigger Vulnerability

A vulnerability exists in the Download Manager plugin for WordPress, in all versions through 3.3.30. The issue arises from a hardcoded Cron key that allows unauthorized access. This key is used in the 'deleteExpired()' and 'clearTempDataCPCron()' functions, enabling unauthenticated attackers to trigger these Cron jobs. As a result, expired posts can be deleted and cache cleared.

Impact

Exploitation of this vulnerability allows for unauthorized triggering of Cron jobs, leading to the deletion of expired posts and clearing of cache.

Remediation

Users can update to version 3.3.31 or a newer patched version to address this vulnerability.