Public mode

No access to your tenant or devices. Every item links to its source. What this means

CVE-2026-92714

Download Manager · information disclosure

CVSS 3.1 6.5 MEDIUMCheck source for fixed versionsKEV status unknown

Original advisory

cve-program · CVE-2026-92714

Published

The Download Manager plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 3.3.68 via the duplicate() function hooked on admin_init. This is due to the handler only verifying the generic 'edit_posts' capability and a plugin-wide static nonce (NONCE_KEY) without any object-level authorization check against the targeted wpdmpro package ID. This makes it possible for authenticated attackers, with Author-level access and above, to duplicate arbitrary Download Manager packages owned by other users (including administrators), which copies all package metadata — including protected file references, role-based access restrictions, and password lock settings — into an attacker-owned clone that they can then edit to remove restrictions and download the previously protected files.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-92714

Published

Download Manager

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "codename065",
                    "product": "Download Manager",
                    "versions": [
                        {
                            "version": "0",
                            "status": "affected",
                            "lessThanOrEqual": "3.3.68",
                            "versionType": "semver"
                        }
                    ],
                    "defaultStatus": "unaffected"
                }

Original source record · Cite this exact observation · Complete original publisher JSON