CVE-2026-14235

HighCVSS 7.5

Published: 27/07/2026(UTC)Updated: 27/07/2026(UTC)Translated: 27/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.23%

14th percentile - higher than 14% of all known CVEs

Summary

The Download Manager WordPress plugin before version 3.3.62 does not bind its temporary download token to the requesting session nor expire it promptly. The token becomes a long-lived, multi-use, portable bearer token. An attacker who obtains one leaked download key can repeatedly download a role- or password-protected package file without authorization.

Risk Assessment

An attacker can gain unauthorized access to protected files, leading to data leakage.

Recommendation

Update the Download Manager plugin to version 3.3.62 or later.

Other vulnerabilities in Download Manager WordPress plugin

CVE-2026-86610Medium
The Download Manager WordPress plugin before 3.3.71 does not sufficiently sanitise and escape a package setting before outputting it back in a page. This could allow users with the Author role and above to perform Stored Cross-Site Scripting attacks against any visitor who opens the package's download dialogue, including administrators. Only sites running PHP below 8.1 are affected.

Original NVD description (English source)

The Download Manager WordPress plugin before 3.3.62 does not bind its temporary download token to the requesting session nor expire it promptly, making the token a long-lived, multi-use, portable bearer token, so that an attacker who obtains one leaked download key can repeatedly download a role- or password-protected package file without authorization.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS