What is the CVSS score of CVE-2026-39676?

CVE-2026-39676 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

Download Manager CVE-2026-39676

EUVD-2026-20355 MEDIUM

Missing Authorization (CWE-862)

2026-04-08 Patchstack

GHSA-q462-ghxj-5ffx

WordPress Authentication Bypass Download Manager Wordpress Plugin Shahjada

5.3

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Primary rating from Vendor (Patchstack) · only source for this CVE.

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Apr 08, 2026 - 08:45 euvd

EUVD-2026-20355

Analysis Generated

Apr 08, 2026 - 08:45 vuln.today

CVE Published

Apr 08, 2026 - 08:30 nvd

MEDIUM 5.3

DescriptionCVE.org

Missing Authorization vulnerability in Shahjada Download Manager download-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Download Manager: from n/a through <= 3.3.52.

AnalysisAI

Remote unauthenticated attackers can bypass access controls in Shahjada Download Manager through version 3.3.52, gaining unauthorized read access to restricted download content due to missing authorization checks. The vulnerability affects all versions up to and including 3.3.52, with an EPSS exploitation probability of 0.02% (4th percentile) indicating minimal real-world risk despite the network-accessible attack vector. No public exploit code or active exploitation has been confirmed.

Technical ContextAI

This is a missing authorization vulnerability (CWE-862) in the Shahjada Download Manager, a WordPress plugin for managing file downloads. The vulnerability stems from incorrectly configured access control security levels that fail to validate user permissions before granting access to download resources. The affected product (cpe:2.3:a:shahjada:download_manager:*:*:*:*:*:*:*:*) relies on access control mechanisms that are bypassable through direct requests without proper privilege checks, allowing unauthenticated network access to restricted content. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) confirms the attack requires no user interaction, no privileges, and no authentication, with low attack complexity, resulting in confidentiality impact but no integrity or availability impact.

RemediationAI

Update Shahjada Download Manager to the latest available version above 3.3.52. Refer to the plugin's official WordPress repository page and the Patchstack vulnerability database (https://patchstack.com/database/Wordpress/Plugin/download-manager/vulnerability/wordpress-download-manager-plugin-3-3-51-broken-access-control-vulnerability?_s_id=cve) for patch availability and release notes. As an interim measure, review and strengthen access control rules at the web server or WordPress level to restrict download endpoints to authenticated users only, and audit existing download access logs for unauthorized retrieval patterns. The NVD advisory (https://nvd.nist.gov/vuln/detail/CVE-2026-39676) provides additional context and patch status updates.