CVE-2026-103964 codename065 CVE debrief

Who should care

Defenders responsible for WordPress installations with the Download Manager plugin, particularly those with subscriber-level access and above, should assess potential exposure and prioritize verification and remediation efforts.

Why it matters

The Download Manager plugin for WordPress is vulnerable to Sensitive Information Exposure, allowing authenticated attackers to extract administrator session cookies, which could lead to session hijacking and account takeover.

• Session hijacking and account takeover are possible consequences of this vulnerability.
• Defenders should verify exposure and assess potential impact, focusing on subscriber-level access and above.
• The plugin's email template and user management features require review for vulnerabilities.

Technical summary

The Download Manager plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.3.71 via the 'first_name' parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to extract the administrator's full Cookie header, including wordpress_logged_in_* session cookies, from the suspension email sent during the administrator's authenticated request.

Defensive priority

Defenders should prioritize verifying exposure and assessing potential impact, focusing on subscriber-level access and above, and review the plugin's email template and user management features.

Recommended defensive actions

• Verify the Download Manager plugin version and update to a patched version if necessary
• Assess subscriber-level access and above for potential exposure
• Review the plugin's email template and user management features for vulnerabilities
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and source item provide details on the vulnerability, including its description, affected versions, and references to the plugin's code. The Download Manager plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.3.71 via the 'first_name' parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to extract the administrator's full Cookie header, including wordpress_logged_in_* session cookies, from the suspension email. To

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.