CVE-2026-110949: Download Manager (Free & Pro) - Unauthenticated Missing Authorization via Password Validation

Q: Which deployments are affected?

The issue affects Download Manager Free versions before 3.3.73 and Download Manager Pro versions before 7.6.2 when a package is protected by both a password and a configured role restriction.

Q: What does an attacker need to exploit this?

An attacker does not need to authenticate, but must know the password for a package that has a role restriction configured. They can then obtain a download key and download the protected file despite not having the required role.

Q: How can I tell whether protected files may have been exposed?

Review packages configured with both passwords and role restrictions, since those are the packages described as vulnerable. Any package password known outside the intended role group could allow unauthenticated download access.

Published Nov 11, 2026

Updated

The Download Manager WordPress plugin before 3.3.73, Download Manager WordPress plugin before 7.6.2 does not verify a package's configured role restriction when validating a package password, allowing an unauthenticated user who knows the password of a role-restricted package to obtain a download key and download the protected file.

Affected Software

2 affected components

WordPress Download Manager Download Manager Free<3.3.73

WordPress Download Manager Download Manager Pro<7.6.2

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Download Manager WordPress (Free) to a version that resolves this vulnerability.
Fixed in 3.3.73
Upgrade
Upgrade Download Manager WordPress (Pro) to a version that resolves this vulnerability.
Fixed in 7.6.2

Event History

Nov 11, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Data Sourced

via NVD·06:17 AM

Description

Frequently Asked Questions

Which deployments are affected?

The issue affects Download Manager Free versions before 3.3.73 and Download Manager Pro versions before 7.6.2 when a package is protected by both a password and a configured role restriction.

What does an attacker need to exploit this?

An attacker does not need to authenticate, but must know the password for a package that has a role restriction configured. They can then obtain a download key and download the protected file despite not having the required role.

How can I tell whether protected files may have been exposed?

Review packages configured with both passwords and role restrictions, since those are the packages described as vulnerable. Any package password known outside the intended role group could allow unauthenticated download access.

CVE-2026-110949: Download Manager (Free & Pro) - Unauthenticated Missing Authorization via Password Validation

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are affected?

What does an attacker need to exploit this?

How can I tell whether protected files may have been exposed?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are affected?

What does an attacker need to exploit this?

How can I tell whether protected files may have been exposed?