CVE-2026-14235: Download Manager WordPress Auth Bypass

CVE-2026-14235 Overview

CVE-2026-14235 affects the Download Manager plugin for WordPress in versions before 3.3.62. The plugin issues a temporary download token that is not bound to the requesting session and does not expire promptly. This design turns the token into a long-lived, multi-use, portable bearer credential. An attacker who obtains a leaked download key can repeatedly download role- or password-protected package files without authorization. The weakness is categorized under [CWE-284] Improper Access Control.

Critical Impact
A single leaked download token grants persistent, reusable access to protected files, bypassing role and password restrictions enforced by the plugin.

Affected Products

Download Manager WordPress plugin versions prior to 3.3.62
WordPress sites using role-restricted downloads via Download Manager
WordPress sites using password-protected packages via Download Manager

Discovery Timeline

2026-07-27 - CVE-2026-14235 published to NVD
2026-07-27 - Last updated in NVD database

Technical Details for CVE-2026-14235

Vulnerability Analysis

The Download Manager plugin generates a temporary token to authorize download requests for protected packages. The token is intended to serve as a short-lived, single-use handle proving that the requester passed the plugin's role or password checks. The implementation fails on two fronts. First, the token is not bound to the session that generated it, so any HTTP client presenting the token is treated as authorized. Second, the token does not expire promptly, extending the window during which a leaked value remains valid. Together these flaws convert the download token into a portable bearer credential.

Root Cause

The root cause is improper access control [CWE-284] in the download authorization flow. The plugin relies on possession of the token as sufficient proof of authorization without correlating it to session identifiers, IP context, or user identity. The absence of a strict expiration policy compounds the design flaw by allowing indefinite reuse.

Attack Vector

An attacker obtains a valid download key through referer leaks, browser history, proxy logs, shared URLs, or interception on unencrypted channels. The attacker then issues repeated HTTP GET requests carrying the token to fetch the protected package. No authentication, user interaction, or elevated privileges are required. The vulnerability impacts confidentiality of files that the plugin was configured to gate behind role or password checks. Refer to the WPScan Vulnerability Report for additional technical detail.

Detection Methods for CVE-2026-14235

Indicators of Compromise

Repeated successful downloads of the same protected package from multiple IP addresses using an identical token parameter.
Access log entries showing download token reuse well after the originating user session has ended.
Unusual User-Agent diversity associated with a single download token value.

Detection Strategies

Parse WordPress access logs for the plugin's download endpoint and correlate token values against originating session identifiers and source IPs.
Alert when a single token services more than one distinct client fingerprint within a short interval.
Baseline expected download volume per protected package and flag statistical outliers.

Monitoring Recommendations

Forward web server and WordPress application logs to a centralized log platform for retention and correlation.
Monitor referer headers and outbound link sharing that could expose download URLs containing tokens.
Track plugin version inventory across WordPress installations and alert on hosts running Download Manager below 3.3.62.

How to Mitigate CVE-2026-14235

Immediate Actions Required

Update the Download Manager plugin to version 3.3.62 or later on all WordPress installations.
Invalidate any download URLs that were previously distributed and regenerate protected package links after patching.
Review web server access logs for evidence of token reuse prior to remediation.

Patch Information

The vendor addressed the issue in Download Manager version 3.3.62. The fix binds download tokens to the requesting session and enforces prompt expiration. Consult the WPScan Vulnerability Report for advisory details and version tracking.

Workarounds

Restrict access to protected download endpoints via web server ACLs or authentication proxies until the plugin is upgraded.
Serve protected files through an alternative access-controlled mechanism, such as authenticated media libraries, until patching completes.
Enforce HTTPS site-wide to reduce token leakage through intercepted traffic and referer headers.

bash

# Update Download Manager via WP-CLI to the fixed version
wp plugin update download-manager --version=3.3.62
wp plugin get download-manager --field=version