CM Download Manager – Organize, Protect & Share Files in WordPress Security & Risk Analysis

The cm-download-manager plugin v3.1.0 presents a mixed security posture. While it demonstrates good practices such as 100% prepared SQL statements and the absence of dangerous functions or file operations, significant concerns remain. The presence of three unprotected AJAX handlers drastically increases the attack surface, offering potential entry points for attackers. The taint analysis, although reporting no critical or high severity flows, did identify two flows with unsanitized paths, which could indicate potential path traversal vulnerabilities if not properly handled by the application logic, despite the absence of explicit file operation calls in static analysis. Furthermore, a history of 10 known CVEs, including critical and high severity issues like Path Traversal, CSRF, and Code Injection, suggests a recurring pattern of security weaknesses in past versions. The most recent vulnerability listed is dated 2025-03-27, which is in the future, implying either an error in the data or a known upcoming vulnerability that is currently unpatched from a historical perspective. The plugin's significant vulnerability history, coupled with the unprotected AJAX endpoints, warrants caution and diligent monitoring for new vulnerabilities.