What is the CVSS score of CVE-2026-2571?

CVE-2026-2571 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of WordPress are affected by CVE-2026-2571?

Organizations using all should be aware of moderate risk from CVE-2026-2571, a information exposure vulnerability rated CVSS 4.3. Sensitive information could be exposed to unauthorized parties.

How to fix or mitigate CVE-2026-2571?

Within 30 days: Identify affected systems running all and apply vendor patches as part of regular patch cycle. Review data exposure and access controls.

WordPress CVE-2026-2571

EUVD-2026-13065 MEDIUM

Information Exposure (CWE-200)

2026-03-19 Wordfence

WordPress Information Disclosure Authentication Bypass

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Mar 19, 2026 - 07:15 euvd

EUVD-2026-13065

Analysis Generated

Mar 19, 2026 - 07:15 vuln.today

CVE Published

Mar 19, 2026 - 06:46 nvd

MEDIUM 4.3

DescriptionCVE.org

The Download Manager plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'reviewUserStatus' function in all versions up to, and including, 3.3.49. This makes it possible for authenticated attackers, with Subscriber-level access and above, to retrieve sensitive information for any user on the site including email addresses, display names, and registration dates.

AnalysisAI

The Download Manager plugin for WordPress contains a missing capability check in the 'reviewUserStatus' function that allows authenticated subscribers and above to access sensitive user information without proper authorization. Affected versions include all releases up to and including 3.3.49, enabling attackers with minimal privileges to retrieve email addresses, display names, and registration dates for any user on the site. While the CVSS score of 4.3 is moderate and the vulnerability requires authentication, the ease of exploitation and the breadth of exposed personal data present a meaningful information disclosure risk for WordPress installations using this plugin.

Technical ContextAI

The vulnerability exists in the Download Manager plugin for WordPress (CPE: cpe:2.3:a:codename065:download_manager:*:*:*:*:*:*:*:*), specifically in the UserController.php file's 'reviewUserStatus' function. The root cause is classified as CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor), stemming from a missing WordPress capability check that should restrict function access to administrators only. The plugin fails to validate user permissions before returning user profile data through an AJAX endpoint, allowing any authenticated user with Subscriber-level access or higher to query arbitrary user information. The vulnerability is present in the code paths referenced in the WordPress plugin repository browser and was addressed in changeset 3462539, indicating that the vendor has acknowledged and patched the issue.

RemediationAI

Upgrade the Download Manager plugin to a version after 3.3.49 immediately, as patches are available in the WordPress plugin repository (see changeset 3462539 referenced at https://plugins.trac.wordpress.org/changeset/3462539/). Before patching, administrators should review subscriber and contributor accounts on their sites to identify any unusual activity, and consider temporarily restricting Subscriber-level registrations if the site allows open registration. For organizations unable to patch immediately, restrict plugin access via web application firewall rules to block AJAX requests to the vulnerable 'reviewUserStatus' function, or temporarily deactivate the plugin pending an update window. Additionally, audit recent user profile queries via WordPress logs to detect any potential exploitation of this vulnerability.