# CVE-2026-92714: WordPress Download Manager IDOR via duplicate function

Source: https://junglewise.ai/threats/cve-2026-92714-wordpress-download-manager-idor-via-duplicate-function  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-18. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-92714 · Severity: medium · CVSS 6.5 · Published 2026-09-18

The Download Manager plugin for WordPress allows authenticated users with Author-level access or higher to duplicate and modify package files that belong to other users, including protected files and administrator-owned packages. An attacker can exploit this to bypass access restrictions, remove password protections, and download sensitive files they should not have access to.

## Quick answers

**Is CVE-2026-92714 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-92714 being exploited in the wild.

**How severe is CVE-2026-92714?** Medium severity, with a CVSS score of 6.5, published 18 September 2026.

**Which products and versions are affected?** Download Manager Download Manager up to 3.3.68.

**Is there a fix for CVE-2026-92714?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-92714 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-92714?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an Insecure Direct Object Reference (IDOR) in the duplicate() function hooked on admin_init. The plugin performs insufficient authorization checks: it verifies only the generic 'edit_posts' capability and relies on a plugin-wide static nonce (NONCE_KEY) without object-level authorization for the targeted wpdmpro package ID. An authenticated attacker with Author-level access or above can directly call the duplicate function with an arbitrary package ID to create an attacker-owned clone of any package, copying all metadata including protected file references and role-based access restrictions. Once cloned, the attacker can edit the cloned package to remove restrictions and access previously protected files. The attack requires only network access and valid WordPress user credentials; no other preconditions exist.

## Affected products

- Download Manager Download Manager up to 3.3.68

## Timeline

- 2026-09-18: disclosed

## References

- [https://plugins.trac.wordpress.org/browser/download-manager/tags/3.3.68/src/Admin/Menu/Packages.php](https://plugins.trac.wordpress.org/browser/download-manager/tags/3.3.68/src/Admin/Menu/Packages.php)
- [https://plugins.trac.wordpress.org/browser/download-manager/tags/3.3.68/src/Admin/Menu/Packages.php](https://plugins.trac.wordpress.org/browser/download-manager/tags/3.3.68/src/Admin/Menu/Packages.php)