CVE-2024-13126: 
WordPress vulnerability analysis and mitigation

The Download Manager WordPress plugin before version 3.3.07 contains a directory listing vulnerability identified as CVE-2024-13126. This security flaw was discovered by Dmitrii Ignatyev and publicly disclosed on February 23, 2025. The vulnerability affects the download-manager plugin for WordPress installations (WPScan).

The vulnerability stems from the plugin's failure to prevent directory listing on web servers that don't utilize htaccess protection. This security weakness is classified under CWE-552 and has been assigned a CVSS score of 5.3 (medium). The vulnerability has been categorized as a FILE DOWNLOAD issue and falls under the OWASP Top 10 category A1: Injection (WPScan).

The vulnerability allows unauthorized access to files stored within the plugin's directory. Attackers can potentially access sensitive files through the exposed directory structure at paths such as 'http://example.com/wp-content/uploads/download-manager-files/' (WPScan).

The vulnerability can be exploited without authentication, making it particularly concerning. A proof of concept exists demonstrating access to the exposed directory at 'wp-content/uploads/download-manager-files/' (WPScan).

The vulnerability has been patched in version 3.3.07 of the Download Manager plugin. Users are advised to update to this version or later to protect against unauthorized file access (WPScan).