medium4.3
CVE-2026-86611
The Download Manager WordPress plugin before 3.3.71, Download Manager WordPress plugin before 7.5.9 does not have CSRF checks in some places, allowing attacker…
Impact
The Download Manager WordPress plugin before 3.3.71, Download Manager WordPress plugin before 7.5.9 does not have CSRF checks in some places, allowing attackers to make a logged in admin update its privacy and storage settings via a crafted link, including the credential that gates its unauthenticated maintenance endpoint.
Affected products
| Product | Affected versions |
|---|---|
| Download Manager WordPress Plugin | before 3.3.71 before 7.5.9 |
Versions were read from the advisory text. No structured product data has been published for this record yet.