CVE-2026-92714: Download Manager <= 3.3.68 - Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Information Disclosure via 'wpdm_duplicate' Parameter
The Download Manager plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 3.3.68 via the duplicate() function hooked on admininit. This is due to the handler only verifying the generic 'editposts' capability and a plugin-wide static nonce (NONCEKEY) without any object-level authorization check against the targeted wpdmpro package ID. This makes it possible for authenticated attackers, with Author-level access and above, to duplicate arbitrary Download Manager packages owned by other users (including administrators), which copies all package metadata — including protected file references, role-based access restrictions, and password lock settings — into an attacker-owned clone that they can then edit to remove restrictions and download the previously protected files.
Affected Software
Event History
Frequently Asked Questions
Which users can exploit this issue?
Authenticated users with Author-level access or higher can exploit it. The vulnerable handler accepts the generic edit_posts capability rather than verifying permission for the specific Download Manager package being duplicated.
What access is required to obtain protected files?
An attacker needs a valid authenticated account with at least Author-level permissions and access to the plugin’s static nonce. They can duplicate a package owned by another user, edit the clone to remove its restrictions, and then download files referenced by the package.
What information or protections can be exposed?
Duplicated packages include metadata such as protected file references, role-based access restrictions, and password lock settings. The attacker can use the copied package to remove those restrictions and access previously protected files.
Are administrator-owned packages affected?
Yes. An Author-level or higher attacker can duplicate arbitrary Download Manager packages owned by other users, including administrators, because there is no object-level authorization check for the targeted package ID.