CVE-2026-2571

Name of the Vulnerable Software and Affected Versions WordPress Download Manager plugin versions up to and including 3.3.49

Description The Download Manager plugin for WordPress is susceptible to unauthorized data access. A missing capability check on the reviewUserStatus() function allows authenticated attackers with Subscriber-level access or higher to retrieve sensitive user information. This information includes email addresses, display names, and registration dates.

Recommendations Update WordPress Download Manager plugin to a version later than 3.3.49.