Download Manager <= 3.3.72 - Unauthenticated Missing Authorization to Protected File Download via Audio, Video and PDF Preview Links
- ID
- WPSEC-2026-1063
- Plugin
- Download Manager (download-manager)
- Affected
- all versions before 3.3.73
- Remediation
- Update to 3.3.73 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- Weakness
- CWE-862
- Usage
- Plugin High · Affected versions High among sites WPSec scans, 2026-10-16
- Attack surface
- Download Manager on WPSec AttackSurface
- Fix released
- Published
Description
The Download Manager plugin for WordPress is vulnerable to unauthorized access to protected files via audio, video and PDF preview links in all versions up to, and including, 3.3.72. This is due to a missing authorization check when the play button, video player and PDF product preview build their media URLs. Each of these URLs carries a temporary download key that skips the package's locks and access roles, and the plugin issued it without checking whether the visitor could access the package or whether the package was locked. This makes it possible for unauthenticated attackers to download the audio, video or PDF files of locked or role-restricted packages whose template shows a play button, video player or product preview.
References
- https://wpsec.com/vuln/WPSEC-2026-1063/
- https://plugins.svn.wordpress.org/download-manager/tags/3.3.73/
- https://wordpress.org/plugins/download-manager/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS