CVE-2026-4057: Download Manager <= 3.3.51 - Missing Authorization to Authenticated (Contributor+) Media File Protection Removal
The Download Manager plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the makeMediaPublic() and makeMediaPrivate() functions in all versions up to, and including, 3.3.51. This is due to the functions only checking for editposts capability without verifying post ownership via currentusercan('editpost', $id), and the destructive operations executing before the admin-level check in mediaAccessControl(). This makes it possible for authenticated attackers, with Contributor-level access and above, to strip all protection metadata (password, access restrictions, private flag) from any media file they do not own, making admin-protected files publicly accessible via their direct URL.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-4057?
CVE-2026-4057 is rated as a high-severity vulnerability due to unauthorized modification of media files.
How do I fix CVE-2026-4057?
To fix CVE-2026-4057, update the Download Manager plugin for WordPress to the latest version that includes the capability checks.
What causes CVE-2026-4057?
CVE-2026-4057 is caused by a missing capability check in the `makeMediaPublic()` and `makeMediaPrivate()` functions in the Download Manager plugin.
Who is affected by CVE-2026-4057?
Users of Download Manager plugin versions up to and including 3.3.51 on WordPress are affected by CVE-2026-4057.
What are the potential impacts of CVE-2026-4057?
The potential impacts of CVE-2026-4057 include unauthorized file access and modification by contributors and authenticated users.