CVE-2026-92714 codename065 CVE debrief

Who should care

WordPress administrators, security teams, and users with Author-level access or above who use the Download Manager plugin, especially in environments with multiple users or sensitive content.

Why it matters

The Download Manager plugin for WordPress has a vulnerability allowing authenticated attackers with Author-level access to duplicate arbitrary packages owned by other users, potentially exposing protected files. This vulnerability requires verification of affected versions and exposure to prioritize remediation efforts.

• Authenticated attackers with Author-level access can duplicate arbitrary Download Manager packages owned by other users, potentially exposing protected files.
• Attackers can bypass role-based access restrictions and password lock settings by editing the duplicated package.
• Remediation priority is high for WordPress installations with multiple users or sensitive content.
• Verification of affected versions and exposure is necessary to prioritize remediation efforts.

Technical summary

The Download Manager plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 3.3.68 via the duplicate() function hooked on admin_init. This is due to the handler only verifying the generic 'edit_posts' capability and a plugin-wide static nonce (NONCE_KEY) without any object-level authorization check against the targeted wpdmpro package ID. The vulnerability allows authenticated attackers, with Author-level access and above, to duplicate arbitrary Download Manager packages owned by other users.

Defensive priority

Assess exposure and prioritize remediation for WordPress installations using the Download Manager plugin, especially those with multiple users or sensitive content.

Recommended defensive actions

• Assess exposure and prioritize remediation for WordPress installations using the Download Manager plugin, especially those with multiple users or sensitive content
• Verify the version of the Download Manager plugin and update to a patched version if necessary
• Monitor for suspicious activity related to package duplication and file access
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability is due to insufficient object-level authorization in the duplicate() function of the Download Manager plugin, allowing attackers to bypass restrictions and access protected files. The plugin only verifies the generic 'edit_posts' capability and a plugin-wide static nonce (NONCE_KEY) without any object-level authorization check against the targeted wpdmpro package ID. This makes it possible for authenticated attackers, with Author-level access and above, to duplicate arbitrary Download Manager packages owned by other

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.