CVE-2021-34639

The Download Manager plugin before version 3.1.25 contains a flaw that permits users with Author-level permissions or higher to upload files using double extensions such as "payload.php.png", potentially resulting in code execution on certain server configurations. Although an .htaccess file in the upload directory provides protection against this issue in typical setups, the vulnerability could be exploited in environments where such protections are not in place.

Based on public CVE data (MITRE/NVD).