Input validation vulnerability in Download Manager 2.9.6

The WordPress Download Manager plugin is vulnerable to a type of attack called Cross-Site Request Forgery in versions up to 2.9.6. This means that unauthenticated attackers can send malicious links to a site administrator and if the administrator clicks on them, they can install malicious plugins or packages. This is because the plugin is missing or not correctly validating nonce validation on the wpdm_install_addon function. To protect yourself against this attack, you should update the WordPress Download Manager plugin to the latest version.