Download Manager <= 3.3.75 - Authenticated (Author+) Missing Authorization to Package File Overwrite via Chunked Upload
- ID
- WPSEC-2026-2747
- Plugin
- Download Manager (download-manager)
- Affected
- all versions before 3.3.76
- Remediation
- Update to 3.3.76 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
- Weakness
- CWE-862
- Usage
- Plugin High · Affected versions High among sites WPSec scans, 2026-11-08
- Attack surface
- Download Manager on WPSec AttackSurface
- Fix released
- Published
Description
The Download Manager plugin for WordPress is vulnerable to unauthorized file overwrite in all versions up to, and including, 3.3.75. This is due to chunked package uploads being assembled in a shared temporary file named only after the destination file name, with no per-user separation, and the finished file being renamed over any existing file of the same name. This makes it possible for authenticated attackers with author-level access or above (users with the upload_files capability) to corrupt or hijack another user's in-progress upload, or to replace an existing package file in the upload directory with their own content.
References
- https://wpsec.com/vuln/WPSEC-2026-2747/
- https://plugins.svn.wordpress.org/download-manager/tags/3.3.76/
- https://wordpress.org/plugins/download-manager/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS