CVE-2026-2571
MEDIUM
4,3
Source: [email protected]
Attack Vector: network
Attack Complexity: low
Privileges Required: low
User Interaction: none
Scope: unchanged
Confidentiality: low
Integrity: none
Availability: none
Description
AI Translation Available
The Download Manager plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'reviewUserStatus' function in all versions up to, and including, 3.3.49. This makes it possible for authenticated attackers, with Subscriber-level access and above, to retrieve sensitive information for any user on the site including email addresses, display names, and registration dates.
200
Exposure of Sensitive Information to an Unauthorized Actor
DraftCommon Consequences
Security Scopes Affected:
Confidentiality
Potential Impacts:
Read Application Data
Applicable Platforms
Technologies:
Mobile, Not Technology-Specific, Web Based
https://plugins.trac.wordpress.org/browser/download-manager/trunk/src/User/User…
https://plugins.trac.wordpress.org/browser/download-manager/trunk/src/User/User…
https://plugins.trac.wordpress.org/browser/download-manager/trunk/src/User/view…
https://plugins.trac.wordpress.org/changeset/3462539/
https://www.wordfence.com/threat-intel/vulnerabilities/id/d3efaa0d-8af6-4cdf-92…