What’s Vulnerable › Vulnerabilities

CVE-2021-34639: WordPress Download Manager <= 3.1.24 Authenticated Arbitrary File Upload

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2021-08-05 · updated 2026-06-17
• Weakness: CWE-646

Description

Authenticated File Upload in WordPress Download Manager <= 3.1.24 allows authenticated (Author+) users to upload files with a double extension, e.g. "payload.php.png" which is executable in some configurations. This issue affects: WordPress Download Manager version 3.1.24 and prior versions.

Affected products

• codename065 Download Manager: through 3.1.24

References

• https://www.wordfence.com/blog/2021/07/wordpress-download-manager-vulnerabilities/
• https://www.wordfence.com/blog/2021/07/wordpress-download-manager-vulnerabilities/

Get alerted when CVE-2021-34639 or the next vulnerability affects your stack