Recently, iThemes (which is being rebranded as SolidWP) and their partner, Patchstack, have been incorrectly labeling that a 100,000+ install WordPress plugin, Download Manager, contained an unfixed vulnerability. The problem stems in part to confusion with a claim that vulnerability had been in Download Manager Pro and also from Patchstack’s data not properly listing which versions of a plugin are vulnerable (this isn’t the first time recently there has been this combinations of problems). Incredibly, once this was brought to iThemes attention by one of their customers, their response was not for them to fix this, but to tell the customer that the plugin developer had to get in touch with Patchstack to address this:

Since the one you’re using is the free version (3.2.70), but it is still being flagged as vulnerable by the Site Scanner, I recommend reaching out to the plugin developers for the possibility of updating the reflected information on Patchstack. [Read more]