The Download Manager WordPress plugin fails to validate a user's identity before allowing a password change. An unauthenticated attacker can modify non‑administrator user passwords through the updatePassword function. After changing the password, the attacker can log in as that user and may gain limited privilege according to the user's role. This vulnerability is rooted in improper authentication handling (CWE‑353).

Codename065's Download Manager plugin for WordPress, versions 3.3.40 and earlier, are affected.

The CVSS score is 7.3, indicating a high impact if exploited. The EPSS score of less than 1 % shows a low probability of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is likely unauthenticated, remote, with the attacker sending crafted HTTP requests to the plugin’s updatePassword endpoint. No authentication is performed before the password change, allowing the attacker to proceed once the request reaches the plugin.