CVE-2026-14235 Download Manager CVE debrief

Who should care

Users of the Download Manager WordPress plugin, especially those with role- or password-protected package files, should be aware of this vulnerability. They should verify their plugin version, apply the latest patch (version 3.3.62 or later), and monitor for suspicious download activity. Additionally, they should consider implementing additional security measures, such as IP blocking or rate limiting, for download access.

Technical summary

The Download Manager WordPress plugin before 3.3.62 does not bind its temporary download token to the requesting session nor expire it promptly, making the token a long-lived, multi-use, portable bearer token. This allows an attacker who obtains one leaked download key to repeatedly download a role- or password-protected package file without authorization. The vulnerability affects users of the plugin, particularly those with role- or password-protected package files.

Defensive priority

Medium

Recommended defensive actions

• Inventory and verify the version of the Download Manager WordPress plugin
• Apply the latest patch (version 3.3.62 or later) to the Download Manager WordPress plugin
• Monitor for suspicious download activity
• Consider implementing additional security measures, such as IP blocking or rate limiting, for download access
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

Evidence is limited; verification of vulnerability details and affected scope is needed. The Download Manager WordPress plugin before 3.3.62 does not bind its temporary download token to the requesting session nor expire it promptly. This makes the token a long-lived, multi-use, portable bearer token. An attacker who obtains one leaked download key can repeatedly download a role- or password-protected package file without authorization. Defenders should verify affected scope, review official advisories, and monitor for suspicious activity.

Official resources