Download Token Bypass in WordPress Download Manager

Executive Summary

This vulnerability affects the WordPress Download Manager plugin before version 3.3.62. It allows unauthorized access to protected files because temporary download tokens are not tied to user sessions or expired promptly. Instead, tokens become long-lived, reusable, and portable, acting like a bearer token. If an attacker obtains a leaked token for a restricted file, they can download it repeatedly without further authentication.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if your WordPress Download Manager plugin version is below 3.3.62. Inspect server logs for repeated unauthorized downloads of protected files using the same token. Look for tokens that remain valid across multiple sessions or IP addresses.

Useful 0 Not Useful 0

Impact Analysis

If you use the affected plugin version, an attacker who steals a download token could access your protected files without your knowledge. The token remains valid for about 10 uses or 11.5 days, allowing repeated unauthorized downloads of role-protected or password-locked files. This could lead to data breaches or unauthorized access to sensitive information.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could violate compliance requirements like GDPR or HIPAA by allowing unauthorized access to protected files. If sensitive data is exposed due to the flaw, it may result in non-compliance with data protection regulations, leading to legal penalties or reputational damage.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update the WordPress Download Manager plugin to version 3.3.62 or later. Review and revoke any exposed download tokens. Monitor for unauthorized access attempts and restrict access to sensitive files.

Useful 0 Not Useful 0