CVE-2026-103964

Name of the Vulnerable Software and Affected Versions Download Manager plugin for WordPress versions prior to 3.3.72

Description Authenticated attackers with subscriber-level access and above can cause sensitive information exposure via the first name parameter. This occurs when an administrator performs a Suspend action against the attacker's account, causing the plugin to synchronously compile and send a suspension email within the administrator's authenticated HTTP request. This process makes the administrator's full Cookie header, including wordpress logged in * session cookies, available to the template engine, allowing the attacker to extract these cookies for session hijacking and full account takeover.

Recommendations Update the Download Manager plugin for WordPress to version 3.3.72 or later.