Executive brief
The Download Manager plugin for WordPress allows authenticated users with Author-level access or higher to duplicate and modify package files that belong to other users, including protected files and administrator-owned packages. An attacker can exploit this to bypass access restrictions, remove password protections, and download sensitive files they should not have access to.
Technical details
The vulnerability is an Insecure Direct Object Reference (IDOR) in the duplicate() function hooked on admin_init. The plugin performs insufficient authorization checks: it verifies only the generic 'edit_posts' capability and relies on a plugin-wide static nonce (NONCE_KEY) without object-level authorization for the targeted wpdmpro package ID. An authenticated attacker with Author-level access or above can directly call the duplicate function with an arbitrary package ID to create an attacker-owned clone of any package, copying all metadata including protected file references and role-based access restrictions. Once cloned, the attacker can edit the cloned package to remove restrictions and access previously protected files. The attack requires only network access and valid WordPress user credentials; no other preconditions exist.
Affected products
- Download Manager Download Manager up to 3.3.68
Timeline
- 2026-09-18: disclosed