Vulnerabilities / Download Manager / WPSEC-2026-2300
Download Manager <= 3.3.74 - Unauthenticated Administrator Name Modification via Refused Registration
Medium 5.3
CWE-754Fixed in 3.3.75
- ID
- WPSEC-2026-2300
- Plugin
- Download Manager (download-manager)
- Affected
- all versions before 3.3.75
- Remediation
- Update to 3.3.75 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-754
- Usage
- Plugin High · Affected versions High among sites WPSec scans, 2026-11-03
- Attack surface
- Download Manager on WPSec AttackSurface
- Fix released
- Published
Description
The Download Manager plugin for WordPress is vulnerable to unauthorized modification of data via the registration form in all versions up to, and including, 3.3.74, due to the signup handler not checking whether wp_create_user() failed and passing the returned WP_Error to wp_update_user() as the user ID, which WordPress reads as user 1. This makes it possible for unauthenticated attackers, when user registration is enabled, to overwrite the display name, first name and last name of the site's first user, usually the administrator.
References
- https://wpsec.com/vuln/WPSEC-2026-2300/
- https://plugins.svn.wordpress.org/download-manager/tags/3.3.75/
- https://wordpress.org/plugins/download-manager/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS