What the vulnerability does
01Description
The Download Manager plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the `makeMediaPublic()` and `makeMediaPrivate()` functions in all versions up to, and including, 3.3.51. This is due to the functions only checking for `edit_posts` capability without verifying post ownership via `current_user_can('edit_post', $id)`, and the destructive operations executing before the admin-level check in `mediaAccessControl()`. This makes it possible for authenticated attackers, with Contributor-level access and above, to strip all protection metadata (password, access restrictions, private flag) from any media file they do not own, making admin-protected files publicly accessible via their direct URL.
Explanation of Vulnerability in Simple Terms
02Summary
Download Manager versions 3.3.51 and earlier lack proper authorization checks, allowing authenticated users to modify content they should not have access to. An attacker with a low-privilege account can alter data through the application. The vulnerability affects the integrity of stored information but does not expose sensitive data or disrupt availability.
What an attacker can do
03Attacker Capabilities
Modify or alter data in the application without proper authorization.
Potential impact on your site
04Site Impact
Unauthorized users can alter content or settings they should not be able to change.
Conditions required to exploit
05Prerequisites
Attacker must have a valid low-privilege user account on the site.
Key dates
06Disclosure timeline
April 10, 2026
CVE published
April 13, 2026
Record updated
