CVE-2020-27344: 
WordPress vulnerability analysis and mitigation

The CVE-2020-27344 vulnerability affects the CM Download Manager WordPress plugin versions before 2.8.0. This cross-site scripting (XSS) vulnerability was discovered and disclosed on October 21, 2020. The vulnerability affects the CreativeMindsSolutions' CM Download Manager plugin, which is a file management solution for WordPress websites (NVD, CVE).

The vulnerability is a Cross-Site Scripting (XSS) issue that exists in the POST request handling of the plugin. Specifically, the vulnerability is present in the 'cmdownload/add/' page and affects the 'filename' parameter in the 'Content-Disposition' Header. The vulnerability has been assigned a CVSS v3.1 Base Score of 6.1 (Medium), with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, indicating that it is network-accessible, requires low attack complexity, needs no privileges, but does require user interaction (GitHub POC).

The vulnerability could allow attackers to execute malicious scripts in the context of the affected website, potentially leading to theft of sensitive information, session hijacking, or defacement of the website. The CVSS scoring indicates low impacts on both confidentiality and integrity, with no impact on availability (NVD).

The vulnerability requires user interaction to be exploited but does not require authentication. A proof of concept exploit has been publicly disclosed, demonstrating the vulnerability in the file upload functionality (GitHub POC).

The vulnerability has been patched in version 2.8.0 of the CM Download Manager plugin. Users are advised to update to this version or later to mitigate the risk. The fix is available through the WordPress plugin repository (WordPress Plugin).