# Download Manager <= 3.3.73 - Authenticated (Subscriber+) Missing Authorization to Private Package Download

- **ID:** WPSEC-2026-1778
- **Plugin:** Download Manager (`download-manager`), https://wordpress.org/plugins/download-manager/
- **Affected versions:** all versions before 3.3.74
- **Fixed in:** 3.3.74 (Update to 3.3.74 or later.)
- **Severity:** Medium 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)
- **Weakness:** CWE-862
- **Usage among sites WPSec scans:** plugin High, affected versions High (as of 2026-10-27)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/download-manager
- **Fix released:** 2026-10-26
- **Published:** 2026-10-27
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1778/

## Description

The Download Manager plugin for WordPress is vulnerable to unauthorized access to restricted files via the package download handler and the showLockOptions AJAX action in all versions up to, and including, 3.3.73, due to a missing check on the package's post status. The download handler only refuses unpublished packages to logged-out visitors, and its later status check accepts private packages by default. This makes it possible for authenticated attackers, with subscriber-level access and above, to download files attached to private packages they cannot read, provided the package's access roles include their role or guests. Draft, pending and scheduled packages are affected only on sites that allow those statuses through the wpdm_downloadable_post_status filter.

## References

- https://wpsec.com/vuln/WPSEC-2026-1778/
- https://plugins.svn.wordpress.org/download-manager/tags/3.3.74/
- https://wordpress.org/plugins/download-manager/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1778/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.