CVE-2026-14235: WordPress Download Manager < 3.3.62 - Unauthorized Protected File Download via Reusable Download Key
The Download Manager WordPress plugin before 3.3.62 does not bind its temporary download token to the requesting session nor expire it promptly, making the token a long-lived, multi-use, portable bearer token, so that an attacker who obtains one leaked download key can repeatedly download a role- or password-protected package file without authorization.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-14235?
CVE-2026-14235 has a risk rating of 48, indicating it has moderate to high severity.
How do I fix CVE-2026-14235?
To remediate CVE-2026-14235, update the WordPress Download Manager plugin to version 3.3.62 or later.
What is CVE-2026-14235 about?
CVE-2026-14235 describes an unauthorized protected file download vulnerability in the WordPress Download Manager plugin due to improper handling of temporary download tokens.
What can attackers do with CVE-2026-14235?
Attackers can exploit CVE-2026-14235 to repeatedly download protected files without proper authorization by using leaked download keys.
Who is affected by CVE-2026-14235?
Users of the WordPress Download Manager plugin version prior to 3.3.62 are affected by CVE-2026-14235.