CVE-2021-24695: tipsandtricks-hq simple_download_monitor Forced Browsing
Vulnerability summary
CVE-2021-24695 is a high (CVSS 7.5) Forced Browsing vulnerability in tipsandtricks-hq simple_download_monitor. EPSS estimates a 1.68% chance of exploitation in the next 30 days, higher than 76.5% of scored vulnerabilities. 1 public exploit is recorded.
Timeline
- 08-11-2021PublishedVulnerability first disclosed.
- 03-08-2024Last modifiedVulnerability information updated.
Description
The Simple Download Monitor WordPress plugin before 3.9.6 saves logs in a predictable location, and does not have any authentication or authorisation in place to prevent unauthenticated users to download and read the logs containing Sensitive Information such as IP Addresses and Usernames
CVSS metrics
3 scores · 2 sources · 2 versions- wordfenceSource5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:NDiffers
EPSS trend
Probability
1.68%
Chance of exploitation in the next 30 days
Percentile
77%
Versus all other CVEs
30-day change
0.00 pp
From 1.68% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (wpscan.com)
Maturity: unknown
Weaknesses
CWE · root cause- CWE-425Direct Request ('Forced Browsing')The web application does not adequately enforce appropriate authorization on all restricted URLs, scripts, or files.
- CWE-200Exposure of Sensitive Information to an Unauthorized ActorThe product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
Affected systems
Tipsandtricks-hq1 product
- simple_download_monitor< 3.9.5
Unknown1 product
- simple download monitor≥ 3.9.6, < 3.9.6
Wordpress1 product
- simple-download-monitor< 3.9.6
3 vendors · 3 products
References
2 links- wpscan.com/vulnerability/d7bdaf2b-cdd9-4aee-b1bb-01728160ff25X Refsource MISCExploitThird Party Advisory