CVE-2024-1232: 
WordPress vulnerability analysis and mitigation

A Cross-Site Request Forgery (CSRF) vulnerability was discovered in CM Download Manager WordPress plugin versions prior to 2.9.0. The vulnerability was assigned CVE-2024-1232 and was publicly disclosed on March 4, 2024. The affected software is the CM Download Manager WordPress plugin, which lacked proper CSRF protection mechanisms in certain functionality (WPScan).

The vulnerability stems from the absence of CSRF checks in specific plugin functionalities. It received a CVSS score of 5.4 (medium severity) and is classified under CWE-352. The vulnerability falls under the OWASP Top 10 category A2: Broken Authentication and Session Management (WPScan).

When exploited, this vulnerability could allow attackers to trick authenticated administrators into deleting downloads from the system without their knowledge or consent through CSRF attacks (WPScan).

The vulnerability can be exploited by crafting a malicious URL in the format 'https://example.com/cmdownload/del/id/' and having an authenticated administrator visit it. The attack requires the victim to be logged in as an administrator at the time of visiting the malicious URL (WPScan).

The vulnerability has been fixed in version 2.9.0 of the CM Download Manager plugin. Users are advised to update to this version or later to protect against potential CSRF attacks (WPScan).