CVE-2026-92714: WordPress Download Manager Auth Bypass

CVE-2026-92714 Overview

CVE-2026-92714 is an Insecure Direct Object Reference [CWE-639] vulnerability in the Download Manager plugin for WordPress, affecting all versions up to and including 3.3.68. The flaw resides in the duplicate() function hooked on admin_init. The handler verifies only the generic edit_posts capability and a plugin-wide static nonce (NONCE_KEY), without performing any object-level authorization check against the targeted wpdmpro package ID. Authenticated attackers with Author-level access or above can duplicate arbitrary Download Manager packages owned by other users, including administrators.

Critical Impact
Attackers can clone protected packages along with their metadata, then strip role-based access restrictions and password locks to download files they were never authorized to access.

Affected Products

WordPress Download Manager plugin versions up to and including 3.3.68
Sites permitting Author-level user registration or trusting low-privileged contributors
Deployments relying on Download Manager role-based access controls or password-locked packages

Discovery Timeline

2026-09-18 - CVE-2026-92714 published to the National Vulnerability Database
2026-09-18 - Last updated in NVD database

Technical Details for CVE-2026-92714

Vulnerability Analysis

The Download Manager plugin exposes a package duplication feature intended for administrators managing their own downloadable assets. The handler runs on the admin_init hook and accepts a target package ID from the request. Before performing the copy, the plugin checks two conditions: the caller must hold the WordPress edit_posts capability, and the request must include a valid plugin-wide static nonce derived from NONCE_KEY. Neither check ties the request to the ownership or ACL configuration of the specific wpdmpro package being duplicated.

When the duplication executes, the plugin copies every metadata field associated with the source package. This includes protected file references, role-based access restrictions, and password lock settings. Ownership of the clone is assigned to the requesting user, who then possesses full edit rights over their new copy. The attacker removes access controls from the duplicate and downloads the underlying files that the original package protected.

Root Cause

The root cause is missing object-level authorization. The duplicate() function treats the edit_posts capability as sufficient proof of intent, but that capability is granted broadly to Author and higher roles. The static nonce provides Cross-Site Request Forgery (CSRF) protection but does not bind the request to a specific package or ownership boundary. Reference implementation lines are documented in the plugin source at src/Admin/Menu/Packages.php and src/Package/PackageController.php.

Attack Vector

An attacker authenticates to the target WordPress site as an Author or higher. The attacker enumerates or guesses the numeric package ID of a target wpdmpro package owned by another user. The attacker issues an authenticated request to the duplication handler, supplying the target package ID and the plugin-wide nonce that any logged-in editor can obtain from the admin interface. The plugin creates a full clone under the attacker's ownership, after which the attacker edits the clone to remove access controls and retrieves the protected files. See the Wordfence Vulnerability Report for additional technical detail.

Detection Methods for CVE-2026-92714

Indicators of Compromise

Creation of duplicate wpdmpro posts within short intervals where the new post author differs from the source package author.
Admin-area HTTP requests invoking the Download Manager duplicate action referencing package IDs the requesting user does not own.
Newly created Download Manager packages with role restrictions or password locks removed shortly after creation.
File download events against packages that were previously restricted, initiated by Author or Editor accounts.

Detection Strategies

Audit wp_posts and wp_postmeta for wpdmpro entries where post authorship changed or where near-identical packages exist under different owners.
Correlate WordPress admin access logs against Download Manager duplicate endpoint invocations and record the acting user role.
Alert on rapid sequences of package duplication followed by edits to access or password metadata fields.

Monitoring Recommendations

Enable WordPress activity logging for all package create, duplicate, and edit operations by non-administrator roles.
Monitor for privilege anomalies where Author-level accounts interact with content they did not create.
Forward web server and PHP application logs to a centralized analytics platform for review of admin-init handler traffic.

How to Mitigate CVE-2026-92714

Immediate Actions Required

Update the Download Manager plugin to a version later than 3.3.68 that addresses the missing object-level authorization check.
Review all Download Manager packages for unauthorized duplicates and remove any suspicious clones.
Rotate credentials for any files that may have been exposed through cloned packages, particularly documents referenced by protected downloads.
Restrict Author-level and higher account creation to trusted users only.

Patch Information

The vendor addressed the vulnerability in a release documented in the WordPress Change Set Overview. Administrators should apply the update through the WordPress plugin manager and verify the installed version is greater than 3.3.68.

Workarounds

Temporarily disable the Download Manager plugin on sites that cannot patch immediately if protected downloads store sensitive content.
Reduce the number of accounts with the edit_posts capability by demoting non-essential Authors to Contributor or Subscriber roles.
Store highly sensitive files outside the Download Manager plugin until the update is applied.

bash

# Verify installed Download Manager plugin version via WP-CLI
wp plugin get download-manager --field=version

# Update the plugin to the latest patched release
wp plugin update download-manager