Download Manager, CVE-2026-2571

CVE, Research URL: CVE-2026-2571
Home page URL: Security reports for Download Manager
Application: Download Manager
Published on: Mar 19, 2026
Research Description: The Download Manager plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'reviewUserStatus' function in all versions up to, and including, 3.3.49. This makes it possible for authenticated attackers, with Subscriber-level access and above, to retrieve sensitive information for any user on the site including email addresses, display names, and registration dates.
Affected versions: max 3.3.50.
Status: vulnerable