{
 "id": "WPSEC-2026-1778",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1778/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1778/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1778/index.md",
 "title": "Download Manager <= 3.3.73 - Authenticated (Subscriber+) Missing Authorization to Private Package Download",
 "description": "The Download Manager plugin for WordPress is vulnerable to unauthorized access to restricted files via the package download handler and the showLockOptions AJAX action in all versions up to, and including, 3.3.73, due to a missing check on the package's post status. The download handler only refuses unpublished packages to logged-out visitors, and its later status check accepts private packages by default. This makes it possible for authenticated attackers, with subscriber-level access and above, to download files attached to private packages they cannot read, provided the package's access roles include their role or guests. Draft, pending and scheduled packages are affected only on sites that allow those statuses through the wpdm_downloadable_post_status filter.",
 "plugin": {
  "slug": "download-manager",
  "name": "Download Manager",
  "full_name": "Download Manager",
  "wordpress_org": "https://wordpress.org/plugins/download-manager/",
  "advisories_url": "https://wpsec.com/vuln/plugin/download-manager/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/download-manager"
 },
 "type": "NO AUTHORISATION",
 "cwe": [
  "CWE-862"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 4.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "3.3.74",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 3.3.74"
  ]
 },
 "introduced_in": null,
 "fixed_in": "3.3.74",
 "remediation": "Update to 3.3.74 or later.",
 "fix_released": "2026-10-26T17:57:01+00:00",
 "published": "2026-10-27T18:42:07+00:00",
 "updated": "2026-10-27T13:39:24.260173+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1778/",
  "https://plugins.svn.wordpress.org/download-manager/tags/3.3.74/",
  "https://wordpress.org/plugins/download-manager/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/download-manager",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "High",
  "affected_versions": "High",
  "as_of": "2026-10-27"
 }
}