The Download Manager plugin for WordPress contains a flaw where the wpdm_media_access AJAX action performs no authorization or capability checks. An attacker who is authenticated, even with only Subscriber level access or higher, can fetch the passwords and access control settings that protect media attachments. Those retrieved credentials enable the attacker to sidestep the intended media protection mechanism and download files that should be restricted. The vulnerability is a straightforward case of missing authorization (CWE-862). The likely attack vector is via in‑application AJAX calls that expose sensitive data without verifying the user’s permissions.

The affected product is the codename065:Download Manager WordPress plugin, specifically all released versions up to and including 3.3.32. No other products or vendors are listed as affected.

The CVSS score of 4.3 indicates a moderate severity. EPSS is below 1%, suggesting that widespread exploitation is unlikely at this time, and the vulnerability is not listed in CISA’s KEV catalog. Nonetheless, any site that has Subscriber–level users can be leveraged to retrieve media passwords, giving those users control over restricted content. Because the flaw requires only authenticated access, the risk to sites with large subscriber bases is non‑negligible, but it does not allow remote code execution or unrestricted system compromise.