CVE-2026-2571: WordPress Download Manager Plugin Flaw

CVE-2026-2571 Overview

The Download Manager plugin for WordPress contains an authorization bypass vulnerability due to a missing capability check on the reviewUserStatus function. This vulnerability affects all versions up to and including 3.3.49, allowing authenticated attackers with Subscriber-level access or higher to retrieve sensitive user information including email addresses, display names, and registration dates for any user on the site.

Critical Impact

Authenticated attackers with minimal privileges (Subscriber-level) can harvest sensitive user data from WordPress sites running vulnerable versions of the Download Manager plugin, potentially leading to targeted phishing campaigns, account takeover attempts, or further exploitation.

Affected Products

• WordPress Download Manager plugin versions up to and including 3.3.49
• WordPress sites with the Download Manager plugin installed and active
• Sites allowing user registration with Subscriber role access

Discovery Timeline

• 2026-03-19 - CVE-2026-2571 published to NVD
• 2026-03-19 - Last updated in NVD database

Technical Details for CVE-2026-2571

Vulnerability Analysis

This vulnerability falls under CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) and represents a Broken Access Control flaw in the WordPress Download Manager plugin. The core issue stems from the reviewUserStatus function in the UserController component lacking proper capability verification before returning user data.

In WordPress, capability checks are the primary mechanism for enforcing authorization on administrative functions. When these checks are missing, any authenticated user—regardless of their assigned role—can invoke privileged functionality. In this case, users with only Subscriber-level access (the lowest authenticated role in WordPress) can query information about any registered user on the site.

The exposed information includes email addresses, display names, and registration dates. While individual pieces of this data might seem benign, the ability to enumerate all users and their associated metadata creates significant reconnaissance opportunities for attackers planning further attacks against the site or its users.

Root Cause

The root cause is a missing capability check in the reviewUserStatus function within the UserController.php file. The vulnerable code path processes requests without verifying whether the current user has administrative permissions to view other users' data. WordPress provides functions like current_user_can() to enforce role-based access control, but these were not implemented in the affected code paths.

The vulnerability spans multiple code locations in the User module, as evidenced by the plugin's source code in the UserController.php and review-user-status.php files.

Attack Vector

The attack is network-based and requires minimal privileges to execute. An attacker must:

1. Create or compromise a WordPress account with at least Subscriber-level access on the target site
2. Authenticate to the WordPress installation
3. Send crafted requests to the reviewUserStatus endpoint
4. Iterate through user IDs to enumerate all users and harvest their sensitive information

The attack does not require any user interaction and can be automated to quickly extract data for all users on a vulnerable WordPress site. Since the attack leverages legitimate authenticated functionality, it may not trigger standard security monitoring unless specific access logging is enabled for the affected endpoints.

Detection Methods for CVE-2026-2571

Indicators of Compromise

• Unusual access patterns to the Download Manager plugin's user review endpoints from non-administrative accounts
• Multiple sequential requests to reviewUserStatus functionality with incrementing or iterating user ID parameters
• Subscriber-level accounts accessing user management functionality they should not have access to
• Log entries showing authenticated requests to /wp-content/plugins/download-manager/src/User/ paths from low-privilege users

Detection Strategies

• Monitor WordPress access logs for requests to Download Manager plugin user endpoints from authenticated sessions with Subscriber or Contributor roles
• Implement application-layer firewall rules to detect and alert on enumeration patterns against user-related endpoints
• Review user activity logs for accounts accessing administrative functions without appropriate roles
• Deploy endpoint detection to identify automated tools performing rapid sequential requests

Monitoring Recommendations

• Enable detailed logging for WordPress plugin requests, particularly for user-related functionality
• Configure alerting for any Subscriber or Contributor-level accounts accessing Download Manager administrative endpoints
• Implement rate limiting on user enumeration endpoints to slow automated attacks
• Review authentication logs for signs of credential stuffing that may precede exploitation attempts

How to Mitigate CVE-2026-2571

Immediate Actions Required

• Update the WordPress Download Manager plugin to version 3.3.50 or later immediately
• Audit access logs for signs of previous exploitation, particularly looking for user enumeration patterns
• Review and remove any unnecessary user accounts, especially inactive Subscriber accounts
• Consider temporarily disabling the Download Manager plugin if immediate patching is not possible

Patch Information

The vulnerability was addressed in WordPress Changeset #3462539. The fix implements proper capability checks on the reviewUserStatus function to ensure only users with appropriate administrative permissions can access sensitive user data. Site administrators should update to the patched version through the WordPress plugin update mechanism.

For additional technical details and vulnerability analysis, refer to the Wordfence Vulnerability Analysis.

Workarounds

• Disable user registration on WordPress sites until the patch is applied if the Download Manager functionality is critical
• Implement web application firewall rules to block access to the vulnerable endpoints from non-administrative users
• Use a WordPress security plugin to add additional capability checks or restrict access to the affected plugin paths
• Temporarily revoke Subscriber and Contributor roles from untrusted users until the update is applied

# Configuration example - Restrict access to vulnerable endpoint via .htaccess
# Add to WordPress root .htaccess file as temporary mitigation

<FilesMatch "review-user-status\.php$">
    Order deny,allow
    Deny from all
    # Allow only from administrative IP addresses
    Allow from 192.168.1.0/24
</FilesMatch>