# Download Manager <= 3.3.72 - Unauthenticated Missing Authorization to Protected File Download via Audio, Video and PDF Preview Links

- **ID:** WPSEC-2026-1063
- **Plugin:** Download Manager (`download-manager`), https://wordpress.org/plugins/download-manager/
- **Affected versions:** all versions before 3.3.73
- **Fixed in:** 3.3.73 (Update to 3.3.73 or later.)
- **Severity:** Medium 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
- **Weakness:** CWE-862
- **Usage among sites WPSec scans:** plugin High, affected versions High (as of 2026-10-16)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/download-manager
- **Fix released:** 2026-10-15
- **Published:** 2026-10-16
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1063/

## Description

The Download Manager plugin for WordPress is vulnerable to unauthorized access to protected files via audio, video and PDF preview links in all versions up to, and including, 3.3.72. This is due to a missing authorization check when the play button, video player and PDF product preview build their media URLs. Each of these URLs carries a temporary download key that skips the package's locks and access roles, and the plugin issued it without checking whether the visitor could access the package or whether the package was locked. This makes it possible for unauthenticated attackers to download the audio, video or PDF files of locked or role-restricted packages whose template shows a play button, video player or product preview.

## References

- https://wpsec.com/vuln/WPSEC-2026-1063/
- https://plugins.svn.wordpress.org/download-manager/tags/3.3.73/
- https://wordpress.org/plugins/download-manager/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1063/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.