CVE-2026-103964 in Download Manager Plugin
Summary
by MITRE • 10/10/2026
The Download Manager plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.3.71 via the 'first_name' parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to extract the administrator's full Cookie header, including wordpress_logged_in_* session cookies, from the suspension email sent during the administrator's authenticated request, enabling full session hijack and account takeover. Exploitation requires an administrator to perform the Suspend action against the attacker's account, which causes the plugin to synchronously compile and send the suspension email inside the administrator's authenticated HTTP request — making the administrator's session cookies available to the template engine at send time.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/10/2026
The Download Manager plugin for WordPress contains a critical vulnerability affecting all versions up to and including 3.3.71, classified under CWE-200 as an Information Exposure issue. This flaw specifically arises from improper handling of sensitive data within the email generation process triggered by administrative actions. The root cause lies in how the plugin constructs suspension emails when an administrator suspends a user account. During this operation, the system synchronously compiles and sends the notification while still operating within the context of the authenticated administrator's session. Consequently, template engines or internal functions involved in rendering the email content inadvertently gain access to sensitive server variables that are typically restricted from such contexts, most notably the HTTP Cookie header containing active session identifiers.
This architectural flaw allows attackers with subscriber-level access and above to exploit the vulnerability through a specific sequence of interactions. By requesting an administrator to suspend their account, the attacker triggers the suspension email generation process within the administrator's authenticated request scope. Because the plugin does not properly isolate the email rendering context from the administrative session data, the full Cookie header is exposed in the resulting output or logs accessible to the user initiating the action. This exposure includes wordpress_logged_in_* cookies, which are essential for maintaining WordPress authentication sessions. The vulnerability effectively bypasses standard access controls by leveraging the elevated privileges of the administrator during a routine management task, turning an administrative function into a vector for credential theft.
The operational impact of this vulnerability is severe, leading directly to full session hijacking and account takeover. Once an attacker obtains the administrator's wordpress_logged_in_* cookie values, they can inject these credentials into their own browser or HTTP client tools to impersonate the site administrator without needing valid login credentials such as a username and password. This capability allows the attacker to execute any action available to an admin user, including modifying site settings, installing malicious plugins, accessing sensitive database information, and potentially compromising the entire WordPress installation and associated backend systems. The attack is particularly dangerous because it requires no complex exploitation techniques or external tools beyond basic HTTP interaction capabilities, relying instead on social engineering tactics to persuade a privileged user into performing the suspension action against the attacker's account.
From a threat intelligence perspective, this vulnerability aligns with MITRE ATT&CK technique T1078, specifically Valid Accounts and Default Accounts sub-techniques related to session hijacking. It also reflects CWE-614 concerning Sensitive Cookie in HTTPS Session Without HttpOnly Flag if the cookies lack appropriate security attributes, although the primary issue here is the improper exposure of these tokens during processing rather than just transmission insecurity. The vulnerability demonstrates a common pattern where server-side template engines or logging mechanisms inadvertently capture and expose request headers that contain authentication secrets, violating the principle of least privilege by granting lower-privileged users access to high-security context data.
Mitigation strategies must focus on immediate remediation through software updates and defensive coding practices. Users should upgrade the Download Manager plugin to a version later than 3.3.71 where this issue has been addressed. Developers implementing similar email generation functionalities in WordPress plugins or themes must ensure that sensitive authentication tokens are never passed into template contexts used for user-facing outputs like emails. Implementing strict separation of concerns between administrative session handling and public notification rendering is essential. Additionally, enforcing HttpOnly flags on all session cookies can mitigate the risk of client-side script access, though it does not prevent server-side exposure during request processing as seen in this case. Regular security audits focusing on data flow from high-privilege contexts to low-privilege outputs are recommended to identify and rectify similar information leakage vulnerabilities across WordPress ecosystems.