Download Manager CVE-2026-86611

Exploitation requires a logged-in Download Manager administrator (versions below 3.3.71 on the legacy branch, or 4.0.0 up to below 7.5.9) to actively visit or interact with an attacker-crafted link while their session is valid (UI:R) - there is no server-side authentication bypass. The vulnerable action is the plugin's privacy and storage settings update, which lacks a CSRF nonce check in some code paths. The practical payload sets the credential that gates the plugin's otherwise-unauthenticated maintenance endpoint. Limiting factors: the attack fails without an authenticated admin session and without admin interaction with the malicious link, and it is bounded to sites running the affected versions; it does not work against patched installs (3.3.71 / 7.5.9 or later) or against non-admin users.

This is a CSRF flaw (CWE-352) with a modest CVSS 4.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N). The network attack vector and low complexity are offset by UI:R - exploitation REQUIRES a logged-in administrator to be tricked into clicking an attacker-crafted link, which is the defining limiter here. Integrity impact is Low and there is no direct confidentiality or availability impact per the vector, consistent with a settings-tampering CSRF rather than direct code execution. Signals are mixed: publicly available exploit code exists (POC via WPScan) and a vendor patch is available, but there is NO CISA KEV listing and no EPSS score was provided in the input, so there is no evidence of active or widespread exploitation. The real-world risk is best characterized as opportunistic/targeted social-engineering against administrators rather than mass automated exploitation - CSRF against an admin-only action does not lend itself to untargeted scanning. Notably, the described impact (an attacker setting the credential that gates the plugin's unauthenticated maintenance endpoint) could enable a follow-on unauthenticated attack path, which raises the practical stakes above what the raw I:L score suggests - but this chaining is inferred from the description, not confirmed by a secondary CVE or advisory. Overall: a real but lower-tier priority - patch in routine cycles, prioritize if administrators are exposed to untrusted links.

An attacker hosts or emails a malicious page/link to a WordPress administrator of a site running a vulnerable Download Manager version. When the logged-in admin visits it, their browser silently submits a forged request that changes the plugin's privacy and storage settings - including the credential that controls access to the unauthenticated maintenance endpoint. Publicly available exploit code (WPScan) demonstrates the forged request, but success depends on the admin being authenticated and interacting with the attacker's link.