CVE-2024-2098: Download Manager Auth Bypass Vulnerability

CVE-2024-2098 Overview

CVE-2024-2098 is a broken access control vulnerability in the Download Manager plugin for WordPress, developed by w3eden. The flaw resides in the protectMediaLibrary function, which fails to perform proper authorization checks. All versions up to and including 3.2.89 are affected. Unauthenticated attackers can leverage this weakness to download password-protected files hosted through the plugin without supplying credentials. The vulnerability is classified under [CWE-289] Authentication Bypass by Alternate Name and [CWE-863] Incorrect Authorization.

Critical Impact
Unauthenticated remote attackers can retrieve password-protected files managed by the Download Manager plugin, leading to disclosure of confidential documents intended only for authorized users.

Affected Products

w3eden Download Manager plugin for WordPress, versions <= 3.2.89
WordPress sites using the free distribution of Download Manager
Any deployment relying on protectMediaLibrary for password-protected file gating

Discovery Timeline

2024-06-13 - CVE-2024-2098 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-2098

Vulnerability Analysis

The Download Manager plugin offers WordPress administrators a method to publish downloadable files with optional password protection. The protectMediaLibrary function is responsible for gating access to those files when they are stored in the WordPress media library. Because the function does not correctly enforce authorization, an attacker can request a protected resource directly and receive the file contents in the response.

The issue is a server-side authorization flaw rather than a client-side restriction. The plugin checks for the presence of certain request parameters but fails to validate that the requester has supplied the correct password or holds an authenticated session. As a result, the protection logic can be bypassed by requesting the underlying media URL.

The vulnerability requires no authentication, no user interaction, and is exploitable over the network. Confidentiality is the primary impact; integrity and availability of the host site are not affected by this specific weakness.

Root Cause

The root cause is an improper authorization check inside the protectMediaLibrary handler. The function does not consistently verify that a request for a protected file originates from a session that has supplied the file's password. This maps to [CWE-863] Incorrect Authorization and [CWE-289] Authentication Bypass by Alternate Name.

Attack Vector

An unauthenticated attacker sends crafted HTTP requests to the WordPress site targeting media library paths governed by the plugin. Because authorization is not enforced server-side, the response returns the password-protected file. The attack vector is network-based and requires only knowledge of, or enumeration of, protected file URLs. See the Wordfence Vulnerability Report for additional technical details.

Detection Methods for CVE-2024-2098

Indicators of Compromise

Unauthenticated GET requests to /wp-content/uploads/ paths associated with Download Manager protected files
Successful HTTP 200 responses returning file content without a preceding password submission POST
Spikes in download activity from single IP addresses targeting media library URLs
Web server logs showing direct access to files that should require the plugin's password prompt

Detection Strategies

Audit installed plugin versions and flag any WordPress site running Download Manager <= 3.2.89
Review access logs for download events that lack a corresponding authentication or password validation request
Correlate user-agent and IP patterns against download volumes to identify scraping behavior

Monitoring Recommendations

Enable detailed HTTP access logging on the WordPress front end and forward logs to a central analytics platform
Alert on repeated requests to file paths managed by the Download Manager plugin from non-authenticated sessions
Monitor for outbound exfiltration patterns following bulk download events

How to Mitigate CVE-2024-2098

Immediate Actions Required

Update the Download Manager plugin to a version newer than 3.2.89 that includes the fix from WordPress Changeset 3072712
Inventory all WordPress sites in the environment and confirm the plugin version after patching
Review download logs for the period prior to patching to identify potential unauthorized file retrieval

Patch Information

The vendor addressed the authorization flaw in the changeset published at plugins.trac.wordpress.org changeset 3072712. Site administrators should apply the update through the WordPress plugin management interface or via WP-CLI.

Workarounds

Temporarily disable the Download Manager plugin until the patched version can be installed
Restrict access to /wp-content/uploads/ directories used by the plugin via web server access rules
Move sensitive files out of the WordPress media library and host them behind a separately authenticated application

bash

# Update Download Manager via WP-CLI on each affected site
wp plugin update download-manager
wp plugin get download-manager --field=version