CVE-2021-34639

CVE-2021-34639 is a high-severity authenticated file upload vulnerability affecting WordPress Download Manager versions 3.1.24 and prior. It allows authenticated users (Author+) to upload files with a double extension (e.g., "payload.php.png"), which can lead to remote code execution in certain server configurations. The vulnerability has a CVSS score of 8.8, indicating a high potential for compromise of confidentiality, integrity, and availability with low attack complexity. While there is no evidence of active exploitation or public exploit code, the vulnerability has garnered some community discussion and media coverage.