CVE-2026-4057
Unauthorized Data Modification in WordPress Download Manager Plugin
Publication date: 2026-04-10
Last updated on: 2026-04-10
Assigner: Wordfence
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| wordfence | download_manager | to 3.3.51 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-862 | The product does not perform an authorization check when an actor attempts to access a resource or perform an action. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
The vulnerability exists in the Download Manager plugin for WordPress, where certain functions responsible for changing media file visibility lack proper capability checks.
Specifically, the functions makeMediaPublic() and makeMediaPrivate() only verify if a user has the 'edit_posts' capability but do not confirm if the user owns the post they are modifying.
Because of this, authenticated users with Contributor-level access or higher can remove protection metadata (such as passwords, access restrictions, or private flags) from media files they do not own.
This results in admin-protected files becoming publicly accessible through their direct URLs.
How can this vulnerability impact me? :
This vulnerability can lead to unauthorized users making protected media files publicly accessible.
An attacker with Contributor-level access or higher can strip away all protection metadata from media files they do not own, bypassing intended access restrictions.
As a result, sensitive or private media content intended to be restricted by administrators could be exposed to the public.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
This vulnerability allows authenticated attackers with Contributor-level access and above to remove protection metadata from media files they do not own, making admin-protected files publicly accessible via their direct URL.
Such unauthorized exposure of protected media files could potentially lead to non-compliance with data protection regulations like GDPR or HIPAA, which require strict control over access to sensitive or private data.
However, the provided information does not explicitly discuss compliance impacts or specific regulatory consequences.