PT-2026-26254 · WordPress · Wordpress Download Manager

Quốc Huy · Published 2026-03-19 · Updated 2026-03-23 · CVE-2026-2571

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions WordPress Download Manager plugin versions up to and including 3.3.49

Description The Download Manager plugin for WordPress is susceptible to unauthorized data access. A missing capability check on the reviewUserStatus() function allows authenticated attackers with Subscriber-level access or higher to retrieve sensitive user information. This information includes email addresses, display names, and registration dates.

Recommendations Update WordPress Download Manager plugin to a version later than 3.3.49.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2026-2571

Affected Products

Wordpress Download Manager

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2026-2571 · Security Note
• https://twitter.com/VulmonFeeds/status/2034542075312587042 · Twitter Post
• https://plugins.trac.wordpress.org/browser/download-manager/trunk/src/User/UserController.php#L109 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/d3efaa0d-8af6-4cdf-9225-8bbcfdbb73d3?source=cve · Note
• https://plugins.trac.wordpress.org/browser/download-manager/trunk/src/User/views/review-user-status.php#L34 · Note
• https://plugins.trac.wordpress.org/browser/download-manager/trunk/src/User/UserController.php#L47 · Note
• https://plugins.trac.wordpress.org/changeset/3462539 · Note
• https://twitter.com/CVEnew/status/2036024240877756731 · Twitter Post