All vulnerabilities
CVE-2026-86611

Download Manager (Free & Pro) - Privacy Settings Update via CSRF

Unknown Download Manager
Open in ThreatlineRecord JSON
CVSS
4.3Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.10%Chance of exploitation activity in the next 30 days, higher than 0% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in3.3.71Also 7.5.9CVE List
Published21 Oct 2026Updated 21 Oct 2026CVE List

What fixes it

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

The Download Manager WordPress plugin before 3.3.71, Download Manager WordPress plugin before 7.5.9 does not have CSRF checks in some places, allowing attackers to make a logged in admin update its privacy and storage settings via a crafted link, including the credential that gates its unauthenticated maintenance endpoint.

Text from CVE List

Affected versions 2

  • Download Manageraffected: all versions before 3.3.71CVE List
  • Download Manageraffected: 4.0.0 before 7.5.9CVE List

References 1