{
 "id": "WPSEC-2026-2297",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2297/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2297/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2297/index.md",
 "title": "Download Manager <= 3.3.74 - Authenticated (Subscriber+) Missing Authorization to Asset Comment Creation and Disclosure",
 "description": "The Download Manager plugin for WordPress is vulnerable to Missing Authorization via the wpdm_addcomment AJAX action in all versions up to, and including, 3.3.74, due to the Asset Manager comment handler not checking whether the user can access the asset. The handler loads any asset by its ID, adds a comment and returns the asset's full comment list. This makes it possible for authenticated attackers, with Subscriber-level access and above, to add comments to Asset Manager assets they cannot access and to read the existing comments on those assets, including the commenters' names and email addresses.",
 "plugin": {
  "slug": "download-manager",
  "name": "Download Manager",
  "full_name": "Download Manager",
  "wordpress_org": "https://wordpress.org/plugins/download-manager/",
  "advisories_url": "https://wpsec.com/vuln/plugin/download-manager/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/download-manager"
 },
 "type": "NO AUTHORISATION",
 "cwe": [
  "CWE-862"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.4,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": "3.1.12",
    "from_inclusive": true,
    "to": "3.3.75",
    "to_inclusive": false
   }
  ],
  "text": [
   "from 3.1.12 before 3.3.75"
  ]
 },
 "introduced_in": "3.1.12",
 "fixed_in": "3.3.75",
 "remediation": "Update to 3.3.75 or later.",
 "fix_released": "2026-11-01T17:54:06+00:00",
 "published": "2026-11-03T14:48:33+00:00",
 "updated": "2026-11-03T13:38:21.297350+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2297/",
  "https://plugins.svn.wordpress.org/download-manager/tags/3.3.75/",
  "https://wordpress.org/plugins/download-manager/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/download-manager",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "High",
  "affected_versions": "High",
  "as_of": "2026-11-03"
 }
}