CVE-2026-86611
CVE-2026-86611 · Download Manager (Free & Pro) - Privacy Settings Update via CSRF
This page contains facts from public vulnerability sources. Check the original advisory before updating.
The Download Manager WordPress plugin before 3.3.71, Download Manager WordPress plugin before 7.5.9 does not have CSRF checks in some places, allowing attackers to make a logged in admin update its privacy and storage settings via a crafted link, including the credential that gates its unauthenticated maintenance endpoint.
CVSS 4.3 · Medium · EPSS 0.1% · Fix available
- Published
- Updated
Affected products and versions
download manager
- Versions
- ≥ 0, < 3.3.71: Affected (semver)
Update to 3.3.71
download manager
- Versions
- ≥ 4.0.0, < 7.5.9: Affected (semver)
Update to 7.5.9