WordPress Download Manager EUVD-2026-96061

Requires an authenticated account with subscriber-level access or above on a site running WordPress Download Manager <= 3.3.71. The decisive limiting factor is that exploitation is not fully attacker-controlled: an administrator must perform the plugin's 'Suspend' action against the attacker's account, which causes the suspension email to be compiled and sent synchronously inside the administrator's own authenticated HTTP request, exposing the admin's wordpress_logged_in_* session cookies to the email template via the 'first_name' parameter path. Exploitation therefore depends on administrator behavior (social engineering or routine moderation) rather than purely on the attacker, and yields the admin session only if the admin is authenticated at send time.

This is a low-to-moderate real-world priority despite the sensitive nature of the data exposed. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, base 4.3) describes a network-reachable, low-complexity flaw requiring only subscriber-level authentication. However, the vendor-assigned vector contains a meaningful inconsistency: it is scored UI:N, yet the description explicitly states exploitation 'requires an administrator to perform the Suspend action against the attacker's account.' That is attacker-uncontrolled privileged interaction and should raise either UI or attack complexity - I have reflected this in my independent assessment below. No exploitation signals corroborate urgency: there is no CISA KEV listing, no public exploit code referenced, and no EPSS score supplied, so there is no public exploit identified at time of analysis. The contrast is clear: the data exposed is severe (a full admin Cookie header including wordpress_logged_in_* cookies enabling complete account takeover), but the exploitation path depends on tricking or waiting for an administrator to manually suspend the attacker's account, which is a strong gating condition. Net: a genuine account-takeover primitive, but one whose real-world exploitability is throttled by the admin-action dependency rather than a 'spray-and-pray' network bug. Prioritize patching, but it is not an emergency relative to unauthenticated RCE-class issues.

An attacker registers a free subscriber account on a WordPress site running Download Manager and sets a crafted value in the 'first_name' field. They then provoke an administrator into using the plugin's Suspend action on their account (e.g., by generating abuse reports); because the suspension email is compiled and sent synchronously within the administrator's authenticated request, the admin's live session cookies are rendered into the email the attacker receives, which the attacker replays to hijack the admin session. No public exploit code is identified at time of analysis.