CVE-2026-92714 Details
Description
The Download Manager plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 3.3.68 via the duplicate() function hooked on admin_init. This is due to the handler only verifying the generic 'edit_posts' capability and a plugin-wide static nonce (NONCE_KEY) without any object-level authorization check against the targeted wpdmpro package ID. This makes it possible for authenticated attackers, with Author-level access and above, to duplicate arbitrary Download Manager packages owned by other users (including administrators), which copies all package metadata — including protected file references, role-based access restrictions, and password lock settings — into an attacker-owned clone that they can then edit to remove restrictions and download the previously protected files.
A vulnerability allowing Insecure Direct Object Reference (IDOR) has been identified in the Download Manager plugin for WordPress, affecting versions through 3.3.68. The issue arises in the duplicate() function, which is triggered on admin_init. The vulnerability exists because the function only checks for the generic 'edit_posts' capability and uses a static nonce (NONCE_KEY) without verifying object-level authorization for the targeted wpdmpro package ID. This flaw enables authenticated attackers with Author-level access or higher to duplicate any Download Manager packages belonging to other users, including administrators. The duplication process transfers all package metadata, such as protected file references, role-based access restrictions, and password lock settings, into a clone owned by the attacker. The attacker can then modify the cloned package to remove restrictions and download previously protected files.
Users are advised to update the Download Manager plugin to version 3.3.69 or a newer patched version.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 18, 2026CISA-ADP
Assessed Sep 18, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-639 | Authorization Bypass Through User-Controlled Key | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Download Manager | <= 3.3.68 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 18, 2026 | CVE Modified | CISA-ADP |
| Sep 18, 2026 | New CVE Received | [email protected] |