Live › vulnerability › CVE-2026-86611
Go to dashboardThe Download Manager WordPress plugin lacks CSRF checks in some places, so a crafted link can make a logged-in admin change its privacy and storage settings. The changed settings include the credential that gates the plugin's unauthenticated maintenance endpoint.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running the Download Manager WordPress plugin below the fixed versions where a logged-in administrator can be tricked into opening a crafted link. Sites without this plugin or running the fixed versions can skip it. unknown whether the sources name a specific affected version range for each branch.
No product ranges from the sources yet.
wp plugin get download-manager --field=version3.3.71 or later, or to 7.5.9 or later on the 7.x lineEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Download Manager WordPress plugin before 3.3.71, Download Manager WordPress plugin before 7.5.9 does not have CSRF checks in some places, allowing attackers to make a logged in admin update its privacy and storage settings via a crafted link, including the credential that gates its unauthenticated maintenance endpoint.
This page as .md · .json · in your agent: get_signal("CVE-2026-86611")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.