CVE-2024-11740

HIGH EXPLOITED NUCLEI

WordPress Download Manager <= 3.3.03 - Unauthenticated Shortcode Execution

Title source: manual
STIX 2.1

Exploitation Summary

CVE-2024-11740 has been observed exploited in the wild (reported by VulnCheck KEV). A Nuclei detection template is also available.

Description

The The Download Manager plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 3.3.03. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.

Nuclei Templates (1)

Download Manager < 3.3.04 - Unauthenticated Arbitrary Shortcode Execution
HIGHVERIFIEDby iamnoooob,rootxharsh,pdresearch

References (3)

Core 3

Scores

CVSS v3 7.3
EPSS 0.0186
EPSS Percentile 76.4%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

CISA SSVC

Vulnrichment
Exploitation none
Automatable yes
Technical Impact partial

Details

VulnCheck KEV 2025-09-11
CWE
CWE-94
Status published
Products (2)
codename065/Download Manager < 3.3.03
w3eden/download_manager < 3.3.04
Published Dec 19, 2024
Tracked Since Feb 18, 2026