Download Manager <= 3.3.73 - Authenticated (Subscriber+) Missing Authorization to Private Package Download
- ID
- WPSEC-2026-1778
- Plugin
- Download Manager (download-manager)
- Affected
- all versions before 3.3.74
- Remediation
- Update to 3.3.74 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
- Weakness
- CWE-862
- Usage
- Plugin High · Affected versions High among sites WPSec scans, 2026-10-27
- Attack surface
- Download Manager on WPSec AttackSurface
- Fix released
- Published
Description
The Download Manager plugin for WordPress is vulnerable to unauthorized access to restricted files via the package download handler and the showLockOptions AJAX action in all versions up to, and including, 3.3.73, due to a missing check on the package's post status. The download handler only refuses unpublished packages to logged-out visitors, and its later status check accepts private packages by default. This makes it possible for authenticated attackers, with subscriber-level access and above, to download files attached to private packages they cannot read, provided the package's access roles include their role or guests. Draft, pending and scheduled packages are affected only on sites that allow those statuses through the wpdm_downloadable_post_status filter.
References
- https://wpsec.com/vuln/WPSEC-2026-1778/
- https://plugins.svn.wordpress.org/download-manager/tags/3.3.74/
- https://wordpress.org/plugins/download-manager/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS