CVE-2022-3076: Cminds Cm Download Manager

High severity, CVSS 7.2. EPSS: 1.5% chance of exploitation in the next 30 days.

The CM Download Manager WordPress plugin before 2.8.6 allows high privilege users such as admin to upload arbitrary files by setting the any extension via the plugin's setting, which could be used by admins of multisite blog to upload PHP files for example.

Affected products

• Cminds Cm Download Manager: before 2.8.6 (fixed in 2.8.6)

Published 2022-09-26. Last modified 2026-06-17.