DOWNLOAD MANAGER · CVE-2026-110949 · Other
NO FIX YET · SEE WHAT TO DO
The Download Manager WordPress plugin does not check a package's role restriction when validating its password. An unauthenticated visitor who knows the password of a role-restricted package can get a download key and download the protected file.
first public Nov 11, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Sites running the Download Manager WordPress plugin that use password-protected packages with a role restriction. The flaw lets an unauthenticated visitor who already knows the password get the file, so sites without role-restricted, password-protected downloads are not exposed through this path. unknown whether other configurations are affected.
Not affected if no-package-passwords, no-role-restricted-packages
Who cares download-manager, self-hosted, wordpress
3.3.73 (for the 3.x line) or 7.6.2 (for the 7.x line), as the description states.The Download Manager WordPress plugin before 3.3.73, Download Manager WordPress plugin before 7.6.2 does not verify a package's configured role restriction when validating a package password, allowing an unauthenticated user who knows the password of a role-restricted package to obtain a download key and download the protected file.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.