The vulnerability is a missing CSRF validation in the Download Manager WordPress plugin (versions prior to 3.3.71 for the free edition and prior to 7.5.9 for the pro edition). An attacker who has control over an administrator session can send a crafted request that updates the plugin’s privacy and storage configuration and sets the credential that protects an otherwise unauthenticated maintenance endpoint. These configuration changes could alter download behavior or weaken the security of maintenance operations.

Affected plugins are the Download Manager WordPress free and pro editions. Versions prior to 3.3.71 in the free release and prior to 7.5.9 in the pro release are vulnerable. The CNA records list the vendor as Unknown: Download Manager; no other vendors or product versions are specified.

The CVSS base score of 4.3 indicates a low‑to‑medium impact. The EPSS score is less than 1%, suggesting a very low probability of exploitation in the wild. The vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is a CSRF attack sent via a crafted link or embedded request, and it requires the attacker to have an active session as a site administrator. Successful exploitation would allow the attacker to reconfigure the plugin’s settings and potentially bypass authentication on maintenance endpoints.