{
 "id": "WPSEC-2026-1063",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1063/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1063/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1063/index.md",
 "title": "Download Manager <= 3.3.72 - Unauthenticated Missing Authorization to Protected File Download via Audio, Video and PDF Preview Links",
 "description": "The Download Manager plugin for WordPress is vulnerable to unauthorized access to protected files via audio, video and PDF preview links in all versions up to, and including, 3.3.72. This is due to a missing authorization check when the play button, video player and PDF product preview build their media URLs. Each of these URLs carries a temporary download key that skips the package's locks and access roles, and the plugin issued it without checking whether the visitor could access the package or whether the package was locked. This makes it possible for unauthenticated attackers to download the audio, video or PDF files of locked or role-restricted packages whose template shows a play button, video player or product preview.",
 "plugin": {
  "slug": "download-manager",
  "name": "Download Manager",
  "full_name": "Download Manager",
  "wordpress_org": "https://wordpress.org/plugins/download-manager/",
  "advisories_url": "https://wpsec.com/vuln/plugin/download-manager/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/download-manager"
 },
 "type": "NO AUTHORISATION",
 "cwe": [
  "CWE-862"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "3.3.73",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 3.3.73"
  ]
 },
 "introduced_in": null,
 "fixed_in": "3.3.73",
 "remediation": "Update to 3.3.73 or later.",
 "fix_released": "2026-10-15T03:32:17+00:00",
 "published": "2026-10-16T11:46:25+00:00",
 "updated": "2026-10-16T10:55:59.830488+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1063/",
  "https://plugins.svn.wordpress.org/download-manager/tags/3.3.73/",
  "https://wordpress.org/plugins/download-manager/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/download-manager",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "High",
  "affected_versions": "High",
  "as_of": "2026-10-16"
 }
}