Vulnerabilities / Download Manager / WPSEC-2026-2297
Download Manager <= 3.3.74 - Authenticated (Subscriber+) Missing Authorization to Asset Comment Creation and Disclosure
Medium 5.4
CWE-862Fixed in 3.3.75
- ID
- WPSEC-2026-2297
- Plugin
- Download Manager (download-manager)
- Affected
- from 3.1.12 before 3.3.75
- Remediation
- Update to 3.3.75 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
- Weakness
- CWE-862
- Usage
- Plugin High · Affected versions High among sites WPSec scans, 2026-11-03
- Attack surface
- Download Manager on WPSec AttackSurface
- Fix released
- Published
Description
The Download Manager plugin for WordPress is vulnerable to Missing Authorization via the wpdm_addcomment AJAX action in all versions up to, and including, 3.3.74, due to the Asset Manager comment handler not checking whether the user can access the asset. The handler loads any asset by its ID, adds a comment and returns the asset's full comment list. This makes it possible for authenticated attackers, with Subscriber-level access and above, to add comments to Asset Manager assets they cannot access and to read the existing comments on those assets, including the commenters' names and email addresses.
References
- https://wpsec.com/vuln/WPSEC-2026-2297/
- https://plugins.svn.wordpress.org/download-manager/tags/3.3.75/
- https://wordpress.org/plugins/download-manager/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS