What is the CVSS score of CVE-2026-4057?

CVE-2026-4057 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

Download Manager CVE-2026-4057

EUVD-2026-21258 MEDIUM

Missing Authorization (CWE-862)

2026-04-10 Wordfence

WordPress Authentication Bypass Download Manager Wordpress Plugin Codename065

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Apr 10, 2026 - 01:45 euvd

EUVD-2026-21258

Analysis Generated

Apr 10, 2026 - 01:45 vuln.today

CVE Published

Apr 10, 2026 - 01:24 nvd

MEDIUM 4.3

DescriptionCVE.org

The Download Manager plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the makeMediaPublic() and makeMediaPrivate() functions in all versions up to, and including, 3.3.51. This is due to the functions only checking for edit_posts capability without verifying post ownership via current_user_can('edit_post', $id), and the destructive operations executing before the admin-level check in mediaAccessControl(). This makes it possible for authenticated attackers, with Contributor-level access and above, to strip all protection metadata (password, access restrictions, private flag) from any media file they do not own, making admin-protected files publicly accessible via their direct URL.

AnalysisAI

Authenticated attackers with Contributor-level or higher access to WordPress sites using the Download Manager plugin (versions up to 3.3.51) can strip protection metadata from any media file, including those they do not own, by exploiting a missing capability check in the makeMediaPublic() and makeMediaPrivate() functions. This allows unauthorized modification of access restrictions, passwords, and private flags on media files, exposing admin-protected content via direct URLs. The vulnerability is non-critical (CVSS 4.3) but represents a privilege escalation and data integrity issue requiring authenticated access.

Technical ContextAI

The Download Manager plugin for WordPress implements media access control through the MediaAccessControl class, which provides functions to manage media file visibility and protection. The vulnerability exists in the makeMediaPublic() and makeMediaPrivate() functions (lines 237 and 257 in MediaAccessControl.php) which perform destructive operations on media metadata before executing proper authorization checks. These functions check only for the generic 'edit_posts' capability without verifying actual post ownership via current_user_can('edit_post', $id), allowing any authenticated user with Contributor privileges to modify media protection settings. The root cause is CWE-862 (Missing Authorization), where authorization logic fails to properly validate that the requesting user has authority over the specific resource being modified. This is a classic privilege escalation scenario in WordPress where granular permission checks (post-specific capabilities) are bypassed in favor of broad capability checks.

RemediationAI

Immediately upgrade the Download Manager plugin to version 3.3.52 or later, which addresses the missing capability check by properly validating post ownership before executing media protection modifications. Site administrators should navigate to Plugins > Installed Plugins in the WordPress admin dashboard, locate Download Manager, and click 'Update Now' to apply the patch. For sites unable to update immediately, restrict Contributor-level access to only trusted authors and monitor media library access logs for unauthorized changes to media protection settings. The fix has been integrated into the plugin repository (changeset 3492316 on the trunk branch); verify the update is deployed before removing access restrictions on contributor accounts.