Junglewise Threat Intelligence

CVE-2026-4057: WordPress Download Manager missing authorization in MediaAccessControl

CVE-2026-4057 · Severity: medium · CVSS 4.3 · Published 2026-04-10

Technologies: W3 Eden Download Manager.

Executive brief

The Download Manager plugin for WordPress, which is used to manage and track file downloads, contains a security flaw that allows unauthorized users to modify file settings. An attacker with a basic contributor account can remove protection settings like passwords and access restrictions from files they do not own. This could result in sensitive or private documents becoming publicly accessible to anyone on the internet.

Technical details

The vulnerability is classified as a missing authorization check (CWE-862) within the `makeMediaPublic()` and `makeMediaPrivate()` functions of the Download Manager plugin. While the functions check for the general `edit_posts` capability, they fail to verify specific post ownership using `current_user_can('edit_post', $id)`. Furthermore, destructive operations are executed before the higher-level administrative checks in `mediaAccessControl()`. An authenticated attacker with Contributor-level permissions or higher can exploit this to remove passwords, access restrictions, and private flags from media files owned by other users, including administrators. This effectively exposes protected files via their direct URLs. The issue is addressed in version 3.3.52.

Affected products

  • W3 Eden Download Manager Up to, and including, 3.3.51

Timeline

  • 2026-04-10: advisory: NVD publication date
  • 2026-04-10: patched: Fixed in version 3.3.52

References