The vulnerability resides in the Download Manager WordPress plugin prior to version 3.3.62. The plugin issues temporary download tokens that are not tied to a specific user session and do not expire promptly. As a result, a download key becomes a long‑lived, reusable bearer token. This flaw is an Improper Access Control vulnerability, classified as CWE-284. An attacker who obtains a leaked download key can use it repeatedly to download any file that the original user’s role or password would normally restrict, thereby bypassing the plugin’s authorization checks and exposing confidential content.

The affected product is the WordPress Download Manager plugin, in all releases earlier than 3.3.62. Any WordPress site that runs an unpatched version of this plugin, regardless of the underlying server or CMS configuration, is vulnerable. Site administrators should identify installations running these older versions to determine risk exposure.

The CVSS score of 7.5 indicates a high severity for unauthorized data access. The EPSS score is 0.00232, and the vulnerability is not listed in the CISA KEV catalog. Based solely on the description, the most likely attack vector is an attacker who has already obtained a download key—through social engineering, compromised site, or other leak—and then uses that key to access protected files. Because the key is reusable across sessions, the vulnerability does not require complex code execution, making exploitation straightforward for anyone who can acquire the token.