Skip to content
fr Sign in
4.3 Medium

CVE-2026-86611 The Download Manager WordPress plugin before 3.3.71, Download Manager WordPress plugin before 7.5.9 does not have CSRF…

Description

The Download Manager WordPress plugin before 3.3.71, Download Manager WordPress plugin before 7.5.9 does not have CSRF checks in some places, allowing attackers to make a logged in admin update its privacy and storage settings via a crafted link, including the credential that gates its unauthenticated maintenance endpoint.

Affected products and versions

Product Affected versions Fixed in
Download Manager 4.0 4.0.0 → < 7.5.9 7.5.9

References

Timeline

  1. Published
  2. Last modified

Other CVEs of Download Manager

The 19 CVEs of Download Manager →
CVE-2026-86610 The Download Manager WordPress plugin before 3.3.71 does not sufficiently sanitise and escape a package setting before… 6.4 Medium CVE-2026-86609 The Download Manager WordPress plugin before 7.5.6 does not sanitise and escape data submitted through its… 8.8 High CVE-2026-14292 The Download Manager WordPress plugin before 3.3.66 does not properly escape a package's title before outputting it in… 5.4 Medium CVE-2026-14235 The Download Manager WordPress plugin before 3.3.62 does not bind its temporary download token to the requesting session… 7.5 High
Track this CVE