# Download Manager <= 3.3.74 - Authenticated (Subscriber+) Missing Authorization to Asset Comment Creation and Disclosure

- **ID:** WPSEC-2026-2297
- **Plugin:** Download Manager (`download-manager`), https://wordpress.org/plugins/download-manager/
- **Affected versions:** from 3.1.12 before 3.3.75
- **Fixed in:** 3.3.75 (Update to 3.3.75 or later.)
- **Severity:** Medium 5.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N)
- **Weakness:** CWE-862
- **Usage among sites WPSec scans:** plugin High, affected versions High (as of 2026-11-03)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/download-manager
- **Fix released:** 2026-11-01
- **Published:** 2026-11-03
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2297/

## Description

The Download Manager plugin for WordPress is vulnerable to Missing Authorization via the wpdm_addcomment AJAX action in all versions up to, and including, 3.3.74, due to the Asset Manager comment handler not checking whether the user can access the asset. The handler loads any asset by its ID, adds a comment and returns the asset's full comment list. This makes it possible for authenticated attackers, with Subscriber-level access and above, to add comments to Asset Manager assets they cannot access and to read the existing comments on those assets, including the commenters' names and email addresses.

## References

- https://wpsec.com/vuln/WPSEC-2026-2297/
- https://plugins.svn.wordpress.org/download-manager/tags/3.3.75/
- https://wordpress.org/plugins/download-manager/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2297/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.