Description
The Download Manager WordPress plugin before 3.3.73, Download Manager WordPress plugin before 7.6.2 does not verify a package's configured role restriction when validating a package password, allowing an unauthenticated user who knows the password of a role-restricted package to obtain a download key and download the protected file.
Published: 2026-11-11
Score: 3.7 Low
EPSS: < 1% Very Low
KEV: No
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

No solution or workaround provided in the CVE record.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 11 Nov 2026 12:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-284
Metrics cvssV3_1

{'score': 3.7, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N'}

Wed, 11 Nov 2026 06:15:00 +0000

Type Values Removed Values Added
Description The Download Manager WordPress plugin before 3.3.73, Download Manager WordPress plugin before 7.6.2 does not verify a package's configured role restriction when validating a package password, allowing an unauthenticated user who knows the password of a role-restricted package to obtain a download key and download the protected file.
Title Download Manager (Free & Pro) - Unauthenticated Missing Authorization via Password Validation
References

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: WPScan

Published:

Updated: 2026-11-11T11:43:42.342Z

Reserved: 2026-10-15T08:41:27.129Z

Link: CVE-2026-110949

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-11-11T06:17:11.477

Modified: 2026-11-11T12:18:32.913

Link: CVE-2026-110949

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses