CVE-2026-39616
Authorization Bypass in dFactory Download Attachments
Publication date: 2026-04-08
Last updated on: 2026-04-29
Assigner: Patchstack
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| dfactory | download_attachments | to 1.4.0 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-639 | The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-39616 is an Insecure Direct Object References (IDOR) vulnerability in the WordPress Download Attachments Plugin versions up to and including 1.4.0.
This vulnerability allows unauthenticated attackers to bypass authorization and authentication mechanisms by exploiting incorrectly configured access control security levels.
As a result, attackers may gain unauthorized access to sensitive files, folders, or database interactions.
The issue is classified under the OWASP Top 10 category A1: Broken Access Control.
How can this vulnerability impact me? :
This vulnerability can allow attackers to bypass security controls and access sensitive information stored or managed by the affected plugin.
Such unauthorized access could lead to exposure of confidential files or data, potentially compromising the security and privacy of your website or users.
Although the CVSS severity score is 5.3 (low severity), the vulnerability is commonly exploited in mass campaigns targeting many websites.
No official patch is currently available, so immediate mitigation involves updating the plugin if possible or seeking assistance from hosting providers or web developers.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability affects the WordPress Download Attachments Plugin versions up to and including 1.4.0 and allows unauthorized access due to broken access control.
To detect if your system is vulnerable, first verify the plugin version installed on your WordPress site.
- Use WP-CLI to check the plugin version: wp plugin list | grep download-attachments
- Manually check the plugin version in the WordPress admin dashboard under Plugins.
To detect exploitation attempts on your network, monitor HTTP requests for unauthorized access patterns to attachment files or direct object references that should be protected.
- Use web server logs to search for suspicious requests, for example: grep -i 'download-attachments' /var/log/apache2/access.log
- Look for requests with unusual parameters or attempts to access files without proper authentication.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation involves updating the affected Download Attachments plugin to a version that is not vulnerable.
Since no official patch is currently available for this vulnerability, if updating is not possible, users should seek assistance from their hosting provider or web developer to implement access control restrictions.
Additionally, consider using security services such as Patchstack's rapid vulnerability mitigation and continuous WordPress security intelligence to help protect your site.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability in the WordPress Download Attachments Plugin (CVE-2026-39616) allows unauthorized access to sensitive files and data by bypassing authorization controls. This unauthorized access could lead to exposure of personal or sensitive information.
Such exposure of sensitive data can negatively impact compliance with data protection regulations and standards like GDPR and HIPAA, which require strict access controls and protection of personal and sensitive information.
Although the vulnerability has a low CVSS severity score (5.3), the risk of unauthorized data access means organizations using the affected plugin should consider the potential compliance implications and take immediate mitigation steps.