# CVE-2026-103964: Download Manager plugin sensitive information exposure in suspension email

Source: https://junglewise.ai/threats/cve-2026-103964-the-download-manager-plugin-for-wordpress-is-vulnerable-to  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-10. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-103964 · Severity: medium · CVSS 4.3 · Published 2026-10-10

The Download Manager plugin for WordPress, used to manage file downloads on websites, exposes administrator session cookies in suspension notification emails. An authenticated attacker with subscriber-level access or higher can trick an administrator into suspending their account, which causes the plugin to send an email containing the administrator's WordPress session cookies. This allows the attacker to hijack the administrator's account and gain full control of the website.

Technologies: [Wordpress Download Manager](https://junglewise.ai/threats/technologies/wordpress-download-manager). Vendors: [Wordpress](https://junglewise.ai/threats/vendors/wordpress).

## Quick answers

**Is CVE-2026-103964 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-103964 being exploited in the wild.

**How severe is CVE-2026-103964?** Medium severity, with a CVSS score of 4.3, published 10 October 2026.

**Which products and versions are affected?** Wordpress Download Manager up to and including 3.3.71.

**Is there a fix for CVE-2026-103964?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-103964 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-103964?** Check whether you run Wordpress Download Manager at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a sensitive information exposure flaw in the suspension email generation mechanism of Download Manager versions up to 3.3.71. When an administrator suspends a user account via the Suspend action, the plugin generates and sends a suspension email using the administrator's authenticated request context, allowing session cookies (wordpress_logged_in_*) to be leaked into the email template. Exploitation requires an authenticated attacker with subscriber-level or higher privileges to trigger administrator action.

## Affected products

- WordPress Download Manager up to and including 3.3.71

## Timeline

- 2026-10-10: disclosed

## References

- [https://plugins.trac.wordpress.org/browser/download-manager/](https://plugins.trac.wordpress.org/browser/download-manager/)
- [https://plugins.trac.wordpress.org/browser/download-manager/tags/3.3.71/src/User/UserController.php](https://plugins.trac.wordpress.org/browser/download-manager/tags/3.3.71/src/User/UserController.php)

## Related threats

- [Download Manager WordPress plugin access control bypass in media preview](https://junglewise.ai/threats/cve-2026-110948-the-download-manager-wordpress-plugin-before-3-3-73-download)
- [WordPress Download Manager reflected XSS in REFERRER parameter](https://junglewise.ai/threats/cve-2026-12054-the-download-manager-plugin-for-wordpress-is-vulnerable-to)
- [Download Manager plugin for WordPress stored XSS via not_found parameter](https://junglewise.ai/threats/cve-2026-9696-the-download-manager-plugin-for-wordpress-is-vulnerable-to-stored)