Security readout for executives and security teams
Plain-English summary
CVE-2022-2436 affects the WordPress Download Manager plugin through version 3.2.49. A logged-in user with Contributor-level access or higher could abuse file handling to trigger unsafe PHP object deserialization, potentially leading to serious site compromise if other required conditions exist.
Executive priority
Treat this as a high-priority WordPress plugin exposure where untrusted authenticated users exist. Sites with only trusted administrators and no affected plugin have lower urgency, but version verification should be prompt because potential impact is full confidentiality, integrity, and availability compromise.
Technical view
The issue is CWE-502 deserialization of untrusted input in the Download Manager plugin's file[package_dir] parameter. Sources describe PHAR wrapper handling that can deserialize attacker-controlled data and invoke arbitrary PHP objects when a usable POP chain exists and the attacker can upload the payload file.
Likely exposure
Exposure is mainly WordPress sites running Download Manager up to and including 3.2.49, especially where Contributor or higher accounts are available to untrusted users. Public anonymous exploitation is not indicated by the source bundle.
Exploitation context
The source bundle does not show CISA KEV listing or confirmed active exploitation. Exploitation requires authentication, Contributor-level privileges or higher, successful upload of a serialized payload file, and a suitable PHP object chain in the environment.
Researcher notes
The affected parameter, PHAR deserialization condition, privilege requirement, upload prerequisite, and POP-chain dependency are all stated in the provided CVE description. The bundle references Wordfence and WordPress Trac material, but does not provide verified exploitation evidence or a specific fixed version.
Mitigation direction
- Inventory WordPress sites for the Download Manager plugin.
- Check installed versions against the affected range: through 3.2.49.
- Follow vendor or Wordfence guidance for the patched version or remediation.
- Disable the plugin if exposure cannot be remediated promptly.
- Limit Contributor and higher roles to trusted users only.
- Review upload permissions for low-privileged WordPress accounts.
Validation and detection
- Confirm whether Download Manager is installed on each WordPress site.
- Record plugin version and compare it with versions through 3.2.49.
- Review WordPress accounts with Contributor privileges or higher.
- Check for unexpected uploads by low-privileged users.
- Review logs for suspicious Download Manager package file activity.
- Confirm remediation against vendor guidance, not assumptions.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-502: Code execution behavior lookup
Code execution and unsafe deserialization weaknesses often justify reviewing execution behavior and process telemetry. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2022-2436 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H2.85.9Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
8.8HighVector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Source materials
- CVE List V5 sourceCVE List V5
- https://www.wordfence.com/threat-intel/vulnerabilities/id/471957f6-54c1-4268-b2e1-8efa391dcaec?source=cveCVE reference
- https://plugins.trac.wordpress.org/browser/download-manager/trunk/src/Admin/Menu/Packages.php#L68CVE reference
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2761422%40download-manager%2Ftrunk%2Fsrc%2FAdmin%2FMenu%2FPackages.php&new=2761422%40download-manager%2Ftrunk%2Fsrc%2FAdmin%2FMenu%2FPackages.phpCVE reference
- https://www.wordfence.com/vulnerability-advisories/#CVE-2022-2436CVE reference
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Deserialization of Untrusted Data
Deserialization of Untrusted Data represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.