PT-2026-26254 · WordPress · Wordpress Download Manager

Quốc Huy · Publicado 2026-03-19 · Atualizado 2026-03-23 · CVE-2026-2571

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions WordPress Download Manager plugin versions up to and including 3.3.49

Description The Download Manager plugin for WordPress is susceptible to unauthorized data access. A missing capability check on the reviewUserStatus() function allows authenticated attackers with Subscriber-level access or higher to retrieve sensitive user information. This information includes email addresses, display names, and registration dates.

Recommendations Update WordPress Download Manager plugin to a version later than 3.3.49.

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2026-2571

Produtos afetados

Wordpress Download Manager

Referências · 8

• https://nvd.nist.gov/vuln/detail/CVE-2026-2571 · Nota de Segurança
• https://twitter.com/VulmonFeeds/status/2034542075312587042 · Publicação no Twitter
• https://plugins.trac.wordpress.org/browser/download-manager/trunk/src/User/UserController.php#L109 · Nota
• https://wordfence.com/threat-intel/vulnerabilities/id/d3efaa0d-8af6-4cdf-9225-8bbcfdbb73d3?source=cve · Nota
• https://plugins.trac.wordpress.org/browser/download-manager/trunk/src/User/views/review-user-status.php#L34 · Nota
• https://plugins.trac.wordpress.org/browser/download-manager/trunk/src/User/UserController.php#L47 · Nota
• https://plugins.trac.wordpress.org/changeset/3462539 · Nota
• https://twitter.com/CVEnew/status/2036024240877756731 · Publicação no Twitter