# Download Manager <= 3.3.74 - Unauthenticated Administrator Name Modification via Refused Registration

- **ID:** WPSEC-2026-2300
- **Plugin:** Download Manager (`download-manager`), https://wordpress.org/plugins/download-manager/
- **Affected versions:** all versions before 3.3.75
- **Fixed in:** 3.3.75 (Update to 3.3.75 or later.)
- **Severity:** Medium 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-754
- **Usage among sites WPSec scans:** plugin High, affected versions High (as of 2026-11-03)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/download-manager
- **Fix released:** 2026-11-01
- **Published:** 2026-11-03
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2300/

## Description

The Download Manager plugin for WordPress is vulnerable to unauthorized modification of data via the registration form in all versions up to, and including, 3.3.74, due to the signup handler not checking whether wp_create_user() failed and passing the returned WP_Error to wp_update_user() as the user ID, which WordPress reads as user 1. This makes it possible for unauthenticated attackers, when user registration is enabled, to overwrite the display name, first name and last name of the site's first user, usually the administrator.

## References

- https://wpsec.com/vuln/WPSEC-2026-2300/
- https://plugins.svn.wordpress.org/download-manager/tags/3.3.75/
- https://wordpress.org/plugins/download-manager/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2300/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.