Sensitive Information Exposure in Download Manager Plugin for WordPress

CVE-2026-103964

What is CVE-2026-103964?

The Download Manager plugin for WordPress is susceptible to sensitive information exposure, affecting all versions up to and including 3.3.71. This vulnerability allows authenticated users with subscriber-level access and above to exploit the 'first_name' parameter. When an administrator performs a Suspend action on the attacker's account, the plugin inadvertently exposes critical session identifiers in the suspension email sent from the administrator’s authenticated request. This can lead to full session hijacking, as it grants attackers access to the administrator's Cookie header, which includes sensitive session cookies necessary for account takeover.

References