Shahjada Download Manager CVE-2026-94405

No special configuration is required: per CVSS AV:N/AC:L/PR:N/UI:N this is remote, unauthenticated exploitation against default installations of the WordPress Download Manager plugin at versions up to and including 3.3.71. Exploitation requires that the attacker can reach an endpoint that accepts a user-controlled key (object/file identifier) and that target sensitive data is embedded/managed by the plugin; the realistic limiting factor is scope of impact rather than access - only data exposed through the vulnerable key-referenced function can be read (C:L), with no write or denial-of-service capability. Risk is further bounded to sites that actually have this plugin installed and store sensitive data within it.

This is a moderate-severity, high-CVSS-but-tempered-real-risk issue. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes a remotely reachable, low-complexity, unauthenticated flaw requiring no user interaction, which maximizes exposure; however, the impact is deliberately scoped to C:L/I:N/A:N - read-only disclosure of some sensitive data with no integrity or availability effect - which is why the base score lands at 5.3 (Medium) rather than Critical. This is a classic IDOR/insecure-direct-object-reference pattern (CWE-639, Authorization Bypass Through User-Controlled Key): an attacker manipulates a user-controlled identifier to retrieve embedded data they should not access. No EPSS probability was supplied, no SSVC decision was provided, there is no CISA KEV listing, and no public POC is referenced, so exploitation status is 'no public exploit identified at time of analysis.' The absence of EPSS/KEV/POC signals is not evidence of safety but does argue against urgent, mass-exploitation prioritization. Overall this is a legitimate but second-tier patch item: easy to exploit if targeted, but limited blast radius and no confirmed exploitation. Note the provided tag 'Authentication Bypass' is imprecise - CWE-639 is an authorization (access-control) bypass, not an authentication bypass.

An unauthenticated remote attacker enumerates or manipulates a user-controlled key (such as a file or object ID in a request parameter) against a site running Download Manager ≤3.3.71, causing the plugin to return embedded sensitive data belonging to other users or protected resources. No authentication, special privileges, or user interaction is required, and because attack complexity is low the request can be scripted and iterated. No public exploit code is identified at time of analysis, but the IDOR pattern is trivial to reproduce manually.