CVE-2024-50507

CRITICAL

DS.DownloadList <1.3 - Code Injection

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2024-50507. PoCs published by RandomRobbieBF.

AI-analyzed exploit summary This repository contains a proof-of-concept for CVE-2024-50507, an unauthenticated PHP Object Injection vulnerability in the DS.DownloadList WordPress plugin (versions up to 1.3). The PoC demonstrates deserialization of untrusted input via a crafted HTTP POST request to `admin-ajax.php`.

Description

Deserialization of Untrusted Data vulnerability in Daschmi DS.DownloadList dsdownloadlist allows Object Injection.This issue affects DS.DownloadList: from n/a through <= 1.3.

Exploits (1)

nomisec WORKING POC
by RandomRobbieBF · poc
https://github.com/RandomRobbieBF/CVE-2024-50507

This repository contains a proof-of-concept for CVE-2024-50507, an unauthenticated PHP Object Injection vulnerability in the DS.DownloadList WordPress plugin (versions up to 1.3). The PoC demonstrates deserialization of untrusted input via a crafted HTTP POST request to `admin-ajax.php`.

Classification
Working Poc 90%
Attack Type
Deserialization
Complexity
Trivial
Reliability
Reliable
Target: DS.DownloadList WordPress plugin <= 1.3
No auth needed
Prerequisites: Target must have DS.DownloadList plugin <= 1.3 installed · No authentication required
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (2)

Core 2

Scores

CVSS v3 9.8
EPSS 0.0102
EPSS Percentile 58.7%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable yes
Technical Impact total

Details

CWE
CWE-502
Status published
Products (2)
Daniel Schmitzer/DS.DownloadList < 1.3
Daschmi/DS.DownloadList < 1.3
Published Oct 30, 2024
Tracked Since Feb 18, 2026