CVE-2026-110948 · Package
NO FIX YET · SEE WHAT TO DO
The Download Manager WordPress plugin does not check whether a visitor may access a package before issuing a download key for its media preview. An unauthenticated visitor can read that key from a public page and download password-locked or role-restricted files.
first public Nov 11, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Sites running the Download Manager WordPress plugin that host password-locked or role-restricted files. Sites that do not use the plugin, or only publish public files, are not exposed to the leak of locked content.
Not affected if no-locked-files, plugin-not-installed
Who cares download-manager, self-hosted, wordpress
3.3.73 or later on the 3.3 line, or to 7.6.2 or later on the 7.6 line.The Download Manager WordPress plugin before 3.3.73, Download Manager WordPress plugin before 7.6.2 does not verify that a visitor is allowed to access a package before its media-preview renderers issue a download key for it, allowing unauthenticated visitors to download password-locked and role-restricted files by reading the key from a public page.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.