vulnerability

WordPress Plugin: download-plugins-dashboard: CVE-2024-35162: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Try Surface Command

Back to search

Severity

CVSS

(AV:N/AC:L/Au:M/C:C/I:N/A:N)

Published

May 17, 2024

Added

May 15, 2025

Modified

Apr 30, 2026

Description

The Download Plugins and Themes in ZIP from Dashboard plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.8.5 via the download_theme function. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information.

Solution

download-plugins-dashboard-plugin-cve-2024-35162

References

https://www.cve.org/CVERecord?id=CVE-2024-35162
https://www.wordfence.com/threat-intel/vulnerabilities/id/9adfc632-2e47-4fea-ad87-41840cdab225?source=api-prod
https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-35217
CVE-2024-35162
https://attackerkb.com/topics/CVE-2024-35162
CWE-22
EUVD-EUVD-2024-35217

Rapid7 Labs

2026 Global Threat Landscape Report

The predictive window has collapsed. Exploitation follows disclosure in days. See how attackers are accelerating and how to stay ahead.

Get report