CVE-2022-0828: 
WordPress vulnerability analysis and mitigation

CVE-2022-0828 affects the Download Manager WordPress plugin versions before 3.2.34. The vulnerability was discovered and disclosed in April 2022. The plugin uses the uniqid PHP function to generate master keys for downloads, which introduces a security weakness in the download access control mechanism (NVD, WPScan).

The vulnerability is classified as CWE-338 (Use of Cryptographically Weak Pseudo-Random Number Generator). The CVSS v3.1 base score is 7.5 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. The vulnerability stems from the implementation of the uniqid PHP function for generating master keys, which produces predictable values that can be exploited (NVD).

The vulnerability allows attackers to bypass role-based restrictions and password protections set for downloads. By successfully exploiting this vulnerability, unauthorized users can gain direct download access to protected files, potentially exposing sensitive or restricted content (WPScan).

Users are advised to update the Download Manager WordPress plugin to version 3.2.34 or later, which addresses this vulnerability by implementing more secure key generation methods (NVD).