CVE-2021-24703: Download Plugin < 1.6.1 - Subscriber+ Arbitrary Plugin Activation

Severity: medium (CVSS 5.7 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2021-11-23 · updated 2026-06-17
Weakness: CWE-732

Description

The Download Plugin WordPress plugin before 1.6.1 does not have capability and CSRF checks in the dpwap_plugin_activate AJAX action, allowing any authenticated users, such as subscribers, to activate plugins that are already installed.

Affected products

metagauss Download Plugin: before 1.6.1 — fixed in 1.6.1

How to fix

Upgrade to a fixed version: metagauss Download Plugin 1.6.1. Check the vendor advisory for mitigations.

References

https://wpscan.com/vulnerability/4ed8296e-1306-481f-9a22-723b051122c0
https://wpscan.com/vulnerability/4ed8296e-1306-481f-9a22-723b051122c0

Get alerted when CVE-2021-24703 or the next vulnerability affects your stack