WordPress CM Download Manager plugin versions 2.0.0 and below suffer from a code injection vulnerability.