CVE-2014-9260

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 11.1% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2017-08-07 · updated 2026-06-17

Description

The basic_settings function in the download manager plugin for WordPress before 2.7.3 allows remote authenticated users to update every WordPress option.

Affected products

codename065 Download Manager: before 2.7.3 — fixed in 2.7.3

How to fix

Upgrade to a fixed version: codename065 Download Manager 2.7.3. Check the vendor advisory for mitigations.

References

http://packetstormsecurity.com/files/130690/WordPress-Download-Manager-2.7.2-Privilege-Escalation.html
http://packetstormsecurity.com/files/130690/WordPress-Download-Manager-2.7.2-Privilege-Escalation.html

Get alerted when CVE-2014-9260 or the next vulnerability affects your stack