# CVE-2026-39676: Shahjada Download Manager missing authorization in access control

Source: https://junglewise.ai/threats/cve-2026-39676-shahjada-download-manager-missing-authorization-in-access-control  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-08. Updated: 2026-07-20  
License: CC BY 4.0 with a link back

CVE-2026-39676 · Severity: medium · CVSS 5.3 · Published 2026-04-08

The Download Manager plugin for WordPress, which is used to manage and track file downloads, contains a security flaw in its access control settings. This vulnerability allows unauthorized individuals to bypass intended security levels, potentially leading to unauthorized modifications or access to download management features. Exploiting this could disrupt file management operations or allow attackers to manipulate how downloads are handled on the site.

## Quick answers

**Is CVE-2026-39676 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-39676 being exploited in the wild.

**How severe is CVE-2026-39676?** Medium severity, with a CVSS score of 5.3, published 8 April 2026.

**Which products and versions are affected?** Shahjada (W3 Eden) Download Manager <= 3.3.52.

**Is there a fix for CVE-2026-39676?** A patch was published on 2026-04-08: Patch available in version 3.3.53 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-39676 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-39676?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A missing authorization (CWE-862) vulnerability exists in the Shahjada Download Manager plugin for WordPress through version 3.3.52. The flaw stems from a failure to properly validate user permissions or security levels within the 'download-manager' component, leading to broken access control. An unauthenticated remote attacker can exploit this by interacting with affected endpoints to perform actions that should be restricted to higher-privileged users. The vulnerability was addressed in version 3.3.53. CVSS analysis indicates a partial impact on integrity or confidentiality depending on the specific configuration.

## Affected products

- Shahjada (W3 Eden) Download Manager <= 3.3.52

## Timeline

- 2026-01-20: other: Reported by researcher Steven Julian
- 2026-02-19: advisory: Initial advisory published by Patchstack
- 2026-04-08: disclosed: CVE-2026-39676 published
- 2026-04-08: patched: Patch available in version 3.3.53

## References

- [https://wordpress.org/plugins](https://wordpress.org/plugins)
- [https://patchstack.com/database/Wordpress/Plugin/download-manager/vulnerability/wordpress-download-manager-plugin-3-3-51-broken-access-control-vulnerability?_s_id=cve](https://patchstack.com/database/Wordpress/Plugin/download-manager/vulnerability/wordpress-download-manager-plugin-3-3-51-broken-access-control-vulnerability?_s_id=cve)