CVE-2026-14235 — WordPress Download Manager < 3.3.62 - Unauthorized Protected File Download via Reusable Download Key
The Download Manager WordPress plugin before 3.3.62 does not bind its temporary download token to the requesting session nor expire it promptly, making the token a long-lived, m…
Published: 2026-07-27 · CVSS: 7.5 · CVSS 3.1
The Download Manager WordPress plugin before 3.3.62 does not bind its temporary download token to the requesting session nor expire it promptly, making the token a long-lived, multi-use, portable bearer token, so that an attacker who obtains one leaked download key can repeatedly download a role- or password-protected package file without authorization.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7