Read the docs
TI-2026-78571 Aliases CVE-2026-86611GHSA-2f6h-f6g2-jxwq

CSRF in Download Manager plugin lets attackers change privacy settings

Priority LOW 19CWE-352Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Tampering
Confidentiality · integrity · availability
None · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-352.

Summary

The Download Manager WordPress plugin before 3.3.71 and from 4.0.0 before 7.5.9 lacks CSRF checks in some places (CWE-352). An attacker can trick a logged-in administrator into following a crafted link, which changes the plugin's privacy and storage settings, including the credential that gates its unauthenticated maintenance endpoint. An exploit link is listed in the references.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

The Download Manager WordPress plugin before 3.3.71, Download Manager WordPress plugin before 7.5.9 does not have CSRF checks in some places, allowing attackers to make a logged in admin update its privacy and storage settings via a crafted link, including the credential that gates its unauthenticated maintenance endpoint.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00132 2nd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA
Fix Fixed Download Manager (Unknown): 3.3.71, 7.5.9

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
UnknownDownload Managerbefore 3.3.713.3.71Patch availableCNA
UnknownDownload Manager4.0.0 to before 7.5.97.5.9Patch availableCNA
  • Download Manager VendorUnknown Affected before 3.3.71 Fixed in 3.3.71 Patch available CNA
  • Download Manager VendorUnknown Affected 4.0.0 to before 7.5.9 Fixed in 7.5.9 Patch available CNA

Remediation

Update the Download Manager plugin to version 3.3.71 for the 3.x line or to version 7.5.9 for the 4.x line.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

  • Fix · CNA Download Manager (Unknown) Fixed in 3.3.71
  • Fix · CNA Download Manager (Unknown) Fixed in 7.5.9

Timeline

  1. 2026-10-21 Threatist record created from CVE-2026-86611
  2. 2026-10-21 Alias added: GHSA-2f6h-f6g2-jxwq

References

Exploit 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences