# Download Manager <= 3.3.75 - Authenticated (Author+) Missing Authorization to Package File Overwrite via Chunked Upload

- **ID:** WPSEC-2026-2747
- **Plugin:** Download Manager (`download-manager`), https://wordpress.org/plugins/download-manager/
- **Affected versions:** all versions before 3.3.76
- **Fixed in:** 3.3.76 (Update to 3.3.76 or later.)
- **Severity:** Medium 5.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L)
- **Weakness:** CWE-862
- **Usage among sites WPSec scans:** plugin High, affected versions High (as of 2026-11-08)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/download-manager
- **Fix released:** 2026-11-07
- **Published:** 2026-11-08
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2747/

## Description

The Download Manager plugin for WordPress is vulnerable to unauthorized file overwrite in all versions up to, and including, 3.3.75. This is due to chunked package uploads being assembled in a shared temporary file named only after the destination file name, with no per-user separation, and the finished file being renamed over any existing file of the same name. This makes it possible for authenticated attackers with author-level access or above (users with the upload_files capability) to corrupt or hijack another user's in-progress upload, or to replace an existing package file in the upload directory with their own content.

## References

- https://wpsec.com/vuln/WPSEC-2026-2747/
- https://plugins.svn.wordpress.org/download-manager/tags/3.3.76/
- https://wordpress.org/plugins/download-manager/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2747/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.