CVE-2026-39676

MediumCVSS 5.3

Published: 08/04/2026(UTC)Updated: 20/07/2026(UTC)Translated: 21/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.19%

9th percentile - higher than 9% of all known CVEs

Summary

The Download Manager plugin for WordPress has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. This issue affects versions up to and including 3.3.52.

Risk Assessment

An attacker can gain unauthorized access to file management functions, potentially leading to data leakage or configuration changes.

Recommendation

It is recommended to immediately update the Download Manager plugin to the latest available version that fixes this vulnerability.

Original NVD description (English source)

Missing Authorization vulnerability in Shahjada Download Manager download-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Download Manager: from n/a through <= 3.3.52.