WordPress Download Manager EUVD-2026-82725

Requires an authenticated account with Author-level capability or higher on a WordPress site running Download Manager (by Codename065) version <=3.3.68; the attacker must be able to invoke the duplicate() function hooked on admin_init using the plugin's static NONCE_KEY nonce and know or enumerate a target wpdmpro package ID. Exploitation is LIMITED to environments that grant untrusted users author/contributor+ roles (multi-author blogs, membership/download sites); it is NOT reachable by anonymous/unauthenticated visitors, and the impact is confined to disclosure of protected files via cloning - the original packages are not altered.

This is a genuine but moderate-priority authorization flaw (CWE-639 IDOR), not a high-CVSS-but-low-real-risk inflation. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N = 6.5) is internally consistent with the description: network-reachable admin_init handler, low complexity, and Author-level authentication (PR:L). The C:H rating is justified because the duplicate() function copies protected file references and role/password restrictions into an attacker-owned clone, ultimately disclosing files the attacker was never authorized to read - a real confidentiality breach rather than a theoretical one. I:N/A:N is correct because the original package is not modified or destroyed; only a copy is created. Exploitation signals temper the urgency: no EPSS score, KEV status, or public PoC was provided, so exploitation status is 'no public exploit identified at time of analysis.' The Wordfence code references (Packages.php#L132-133, PackageController.php#L2425) effectively document the mechanism, lowering the bar to reproduce even without a packaged exploit. The main limiting factor is that the attacker must already hold Author-level (or higher) access on the target site, which confines the threat to multi-author blogs, membership sites, and platforms that grant contributor/author accounts - not anonymous internet attackers. Net: a defensible medium-severity issue that matters most where untrusted users hold authoring roles.

An attacker with an Author-level account on a WordPress site running Download Manager <=3.3.68 sends a crafted admin_init request invoking duplicate() against a wpdmpro package ID owned by an administrator. Because the handler only checks the generic edit_posts capability and a static plugin-wide nonce, the attacker receives a full clone of the protected package - including references to gated files - which they then edit to strip password/role restrictions and download the previously protected content. No public exploit code was identified at time of analysis, but the vendor advisory cites the exact vulnerable source lines, making reproduction straightforward.