CVE-2026-92714 in Download Manager Plugin
Summary
by MITRE • 09/18/2026
The Download Manager plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 3.3.68 via the duplicate() function hooked on admin_init. This is due to the handler only verifying the generic 'edit_posts' capability and a plugin-wide static nonce (NONCE_KEY) without any object-level authorization check against the targeted wpdmpro package ID. This makes it possible for authenticated attackers, with Author-level access and above, to duplicate arbitrary Download Manager packages owned by other users (including administrators), which copies all package metadata — including protected file references, role-based access restrictions, and password lock settings — into an attacker-owned clone that they can then edit to remove restrictions and download the previously protected files.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/18/2026
The vulnerability identified in WordPress Download Manager plugin versions up to 3.3.68 represents a critical failure in object-level authorization controls, specifically classified as an Insecure Direct Object Reference or Broken Access Control issue under CWE-284. This flaw resides within the duplicate() function which is hooked into the admin_init action hook. The core technical deficiency lies in the authentication and authorization logic employed by this handler. While the plugin correctly verifies that the requesting user possesses a generic capability such as edit_posts, it fails to validate whether the specific resource being accessed belongs to or is authorized for access by that particular user. Instead of checking ownership or permissions associated with the targeted wpdmpro package ID, the system relies solely on a static nonce derived from NONCE_KEY and the broad role-based permission check. This architectural oversight allows any authenticated user with at least Author-level privileges to bypass intended security boundaries because the validation mechanism does not distinguish between resources owned by the requester versus those owned by other users or administrators.
The operational impact of this vulnerability is severe, enabling privilege escalation through data exfiltration and policy circumvention rather than direct code execution. An attacker leveraging this flaw can duplicate arbitrary Download Manager packages regardless of their ownership status. This duplication process creates a new instance of the package that retains all associated metadata from the original source. Crucially, this includes sensitive configuration details such as protected file references, role-based access restrictions, and password lock settings. Once the vulnerable function executes, the attacker gains possession of an exact clone of the target resource within their own account space. This effectively neutralizes the security controls applied to the original package because the new instance is owned by the attacker, allowing them full administrative control over it without needing further authorization checks from the system.
Following the successful duplication, the attacker can modify the cloned package to strip away any remaining protective measures such as password locks or role-based access restrictions. With these safeguards removed, the attacker gains unrestricted download capabilities for files that were previously intended to be private or restricted to specific user groups. This leads directly to unauthorized data disclosure and potential intellectual property theft. The attack path aligns with ATT&CK technique T1078 Valid Accounts, as it requires initial authentication but exploits weak access control logic rather than credential compromise. It also reflects aspects of T1530 Data from Cloud Storage if the protected files are hosted externally, or general data exfiltration patterns where sensitive assets are copied to an attacker-controlled location for later retrieval.
Mitigation strategies must address both immediate remediation and long-term architectural improvements. The primary solution is to upgrade the WordPress Download Manager plugin to a version greater than 3.3.68 where this specific authorization check has been corrected by the developers. For environments unable to patch immediately, administrators should restrict access to the admin_init hook or disable the duplicate functionality if it is not strictly required for business operations. Furthermore, implementing strict object-level permission checks in custom code development practices is essential to prevent similar flaws. Developers must ensure that every operation involving a specific resource ID verifies ownership or explicit delegation of rights before proceeding with data manipulation. Regular security audits focusing on access control logic and the implementation of principle of least privilege can significantly reduce the risk surface for such vulnerabilities across WordPress ecosystems.