Download Manager tokens remain reusable outside the issuing session
Download Manager before 3.3.62 issues temporary download tokens that are not bound to the session that requested them and are not promptly expired. Anyone who obtains a leaked token can reuse it as a long-lived bearer credential to repeatedly download a role-protected or password-protected package without the original user's session. The CNA record does not identify the token parameter, route or validation function.
- Component
- Download Manager
- Plugin slug
download-manager- Affected
- < 3.3.62
- Safe version
3.3.62- Published
- Jul 27, 2026
This CVE was published Jul 27, 2026 and is one of 67 known issues for this plugin.
Update, patch or deactivate.
Update Download Manager to 3.3.62 or later. Revoke or regenerate protected download links, review download logs for repeated use of the same token from unrelated clients and rotate secrets contained in any package that may have been exposed.
A safe version is available, so updating to that version or later is the preferred remediation. If an immediate update is not practical, consider a targeted application patch or temporarily restricting the affected functionality.
Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.
Technical description
The Download Manager WordPress plugin before 3.3.62 does not bind its temporary download token to the requesting session nor expire it promptly, making the token a long-lived, multi-use, portable bearer token, so that an attacker who obtains one leaked download key can repeatedly download a role- or password-protected package file without authorization.
CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N