CVE-2026-94405: WordPress Download Manager plugin <= 3.3.71 - Sensitive Data Exposure vulnerability
Authorization Bypass Through User-Controlled Key vulnerability in Shahjada Download Manager allows Retrieve Embedded Sensitive Data.
This issue affects Download Manager: from n/a through 3.3.71.
Affected Software
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
The vulnerability is remotely exploitable with low attack complexity and requires no authentication or user interaction. It involves an authorization bypass through a user-controlled key.
What is the impact of successful exploitation?
A successful attacker may retrieve embedded sensitive data. The provided severity vector indicates low confidentiality impact, with no stated integrity or availability impact.
Which installations are affected?
Download Manager versions through 3.3.71 are affected. The affected version range begins at an unspecified earlier version, so installations running 3.3.71 or an older version within the plugin's affected range should be treated as potentially vulnerable.