A missing capability check in the MakeMediaPublic and MakeMediaPrivate functions of the Download Manager plugin allows any authenticated user with Contributor-level access or higher to remove protection metadata from media files they do not own. The plugin only verifies the edit_posts capability, ignoring ownership checks, and the operations are performed before a higher-level admin check. This can cause files that should remain private to become publicly accessible via their direct URLs, exposing potentially sensitive content.

The vulnerability affects all installations of the Download Manager plugin for WordPress up to and including version 3.3.51. Affected implementations belong to the codename065 vendor and operate as part of a WordPress site’s media library.

The CVSS score of 4.3 indicates moderate severity, and no EPSS score is available. The attack requires authenticated access with Contributor or greater role, leveraging the plugin’s public endpoints. Although the CVE is not listed in KEV, the direct nature of the exploit and the lack of restriction on the affected functions increase the likelihood of use in environments where contributors have access. Organizations should consider the potential for unintended data exposure and the ease of exploitation when assessing risk.