CVE-2022-0828 Master Key bruteforce Wordpress Download Manager plugin

1. Vulnerability Properties

Title: Master Key bruteforce Wordpress Download Manager plugin
CVE ID: CVE-2022-0828
CVSSv3 Base Score: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Vendor: W3 Eden, Inc
Products: Wordpress Download Manager plugin
Advisory Release Date: 22-07-2022
Advisory URL:
Credits: Discovery by Diogo Real <dr[at]>

2. Vulnerability Summary

Due to the use of the function uniqid to generate files “master keys” is it possible for an unauthenticated attacker to bypass files protected by password, or roles restrictions mechanisms by bruteforcing the master key value.

3. Vulnerable Versions

  • < 3.2.39

4. Solution

  • Update to version 3.2.4 or higher

5. Vulnerability Timeline

  • 2/Mar/22  - Bug reported
  • 22/Jul/22 - Advisory released

6. References


© 2024 INTEGRITY S.A. All rights reserved. | Cookie Policy

Cookie Consent X

Integrity S.A. uses cookies for analytical and more personalized information presentation purposes, based on your browsing habits and profile. For more detailed information, see our Cookie Policy.