CVE-2026-86611 — Download Manager (Free & Pro) - Privacy Settings Update via CSRF

CVE-2026-86611

Download Manager (Free & Pro) - Privacy Settings Update via CSRF PUBLISHED

Description (CNA)

The Download Manager WordPress plugin before 3.3.71, Download Manager WordPress plugin before 7.5.9 does not have CSRF checks in some places, allowing attackers to make a logged in admin update its privacy and storage settings via a crafted link, including the credential that gates its unauthenticated maintenance endpoint.

Affected (CNA)

Vendor / product	Versions
Unknown / Download Manager	affected 0 before 3.3.71
Unknown / Download Manager	affected 4.0.0 before 7.5.9

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/07ed3827-e52e-4021-91ed-511fc5f554ba/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.