CVE-2024-27190 Overview
CVE-2024-27190 is a missing authorization vulnerability in the Jean-David Daviet Download Media plugin for WordPress. The flaw affects all versions up to and including 1.4.2. The plugin fails to enforce proper authorization checks on sensitive functionality, allowing authenticated users with low privileges to perform actions restricted to higher-privileged roles. The weakness is tracked under CWE-862 (Missing Authorization).
Critical Impact
An authenticated attacker with low privileges can bypass access controls in the Download Media plugin, compromising confidentiality, integrity, and availability of the affected WordPress site.
Affected Products
- Jean-David Daviet Download Media WordPress plugin
- All versions from n/a through 1.4.2
- WordPress sites with the Download Media plugin installed and activated
Discovery Timeline
- 2024-03-21 - CVE-2024-27190 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-27190
Vulnerability Analysis
The Download Media plugin exposes functionality without validating whether the calling user holds the required capability. Under CWE-862, the application performs a sensitive action without verifying that the requester is authorized. In WordPress plugins, this pattern typically occurs when admin-ajax.php handlers or REST endpoints omit current_user_can() capability checks or nonce validation.
An attacker with a low-privilege authenticated account, such as a subscriber, can invoke plugin actions intended for administrators or editors. The result is broken access control affecting site content and configuration through the plugin's exposed endpoints.
Root Cause
The plugin's action handlers do not enforce capability checks before executing privileged operations. Authorization logic is either missing or relies on assumptions about the client rather than server-side validation of the user's role and permissions.
Attack Vector
Exploitation requires network access to the WordPress site and a valid authenticated session with minimal privileges. The attacker sends crafted HTTP requests to the plugin's endpoints, triggering the unprotected functionality. No user interaction is required beyond the attacker's own authenticated request.
Technical details are documented in the Patchstack advisory for the Download Media plugin.
Detection Methods for CVE-2024-27190
Indicators of Compromise
- Unexpected requests to Download Media plugin endpoints from low-privilege user sessions
- WordPress access logs showing admin-ajax.php or plugin-specific URLs invoked by subscriber-level accounts
- Unauthorized media uploads, downloads, or configuration changes attributed to non-administrative users
- New or modified files in wp-content/uploads without corresponding administrator activity
Detection Strategies
- Audit WordPress user activity logs for privilege boundary violations tied to the Download Media plugin
- Correlate authenticated HTTP requests with the user's assigned role to identify capability mismatches
- Monitor plugin-specific AJAX actions for invocations by non-privileged users
Monitoring Recommendations
- Enable WordPress security plugins that log capability checks and administrative actions
- Forward web server access logs to a centralized data lake for retention and query
- Alert on repeated POST requests to plugin endpoints from accounts that should not require them
How to Mitigate CVE-2024-27190
Immediate Actions Required
- Identify all WordPress sites running the Download Media plugin at version 1.4.2 or earlier
- Deactivate the plugin until a patched version is confirmed installed
- Review user accounts and revoke unnecessary subscriber or contributor access
- Rotate credentials for any accounts that may have been used to exploit the flaw
Patch Information
No fixed version is documented in the enriched advisory data. Site administrators should consult the Patchstack advisory and the plugin's official page for updated releases addressing the missing authorization check.
Workarounds
- Deactivate and remove the Download Media plugin if a patched version is unavailable
- Restrict user registration to reduce the population of low-privilege accounts that could exploit the flaw
- Deploy a Web Application Firewall rule to block unauthenticated or low-privilege requests to the plugin's endpoints
- Enforce least-privilege role assignment across all WordPress user accounts
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
