CVE-2026-86611: Download Manager (Free & Pro) - Privacy Settings Update via CSRF
The Download Manager WordPress plugin before 3.3.71, Download Manager WordPress plugin before 7.5.9 does not have CSRF checks in some places, allowing attackers to make a logged in admin update its privacy and storage settings via a crafted link, including the credential that gates its unauthenticated maintenance endpoint.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Download Manager WordPress plugin (Free)to a version that resolves this vulnerability.Fixed in 3.3.71 - Upgrade
Upgrade
Download Manager WordPress plugin (Pro)to a version that resolves this vulnerability.Fixed in 7.5.9
Event History
Frequently Asked Questions
Who is realistically exposed to this issue?
Sites using the affected Download Manager plugin with a logged-in WordPress administrator are exposed. An attacker must be able to induce that administrator to open a crafted link.
What can an attacker change through the CSRF flaw?
The attacker can cause a logged-in administrator to update the plugin's privacy and storage settings. This can include changing the credential that protects the plugin's unauthenticated maintenance endpoint.
Which plugin versions need remediation?
The issue affects Download Manager versions before 3.3.71 and versions before 7.5.9. Upgrade to the applicable fixed version or later.