CVE-2026-86611 PUBLISHED

Download Manager (Free & Pro) - Privacy Settings Update via CSRF

Assigner: WPScan
Reserved: 08.09.2026 Published: 21.10.2026 Updated: 21.10.2026

The Download Manager WordPress plugin before 3.3.71, Download Manager WordPress plugin before 7.5.9 does not have CSRF checks in some places, allowing attackers to make a logged in admin update its privacy and storage settings via a crafted link, including the credential that gates its unauthenticated maintenance endpoint.

Product Status

Vendor Unknown
Product Download Manager
Versions Default: unaffected
  • affected from 0 to 3.3.71 (excl.)
Vendor Unknown
Product Download Manager
Versions Default: unaffected
  • affected from 4.0.0 to 7.5.9 (excl.)

Credits

  • Kartik Sharma finder
  • WPScan coordinator

References

Problem Types

  • CWE-352 Cross-Site Request Forgery (CSRF) CWE