The vulnerability in the Download Manager WordPress plugin is caused by a hard‑coded cron key used in deleteExpired() and clearTempDataCPCron(). An attacker can call these functions without authentication, which results in deletion of expired posts and clearing of cached data, potentially causing loss of posts and site performance issues.

Codename065’s Download Manager plugin for WordPress, version 3.3.30 and older, is affected. All installations of the plugin up to that release are vulnerable.

The CVSS score of 5.3 indicates moderate severity. EPSS shows less than 1% exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. Attackers would need to send a request containing the hard‑coded key, which is likely embedded in the code, to trigger the cron jobs. Without user authentication, the attack can be performed by anyone who can reach the target site. Given the low EPSS, widespread exploitation is unlikely, but the impact on content loss warrants patching.