CyberRota Analysis
AI-GeneratedThe Download Manager plugin for WordPress versions prior to 3.3.62 is vulnerable due to its failure to bind temporary download tokens to user sessions and lack of timely expiration, allowing attackers to exploit leaked tokens for unauthorized access to protected files. This high-severity vulnerability poses a significant risk to websites using the affected plugin, particularly those handling sensitive or private content. WordPress administrators and security teams should prioritize updating to the latest version to mitigate potential data breaches.
Original NVD Description
The Download Manager WordPress plugin before 3.3.62 does not bind its temporary download token to the requesting session nor expire it promptly, making the token a long-lived, multi-use, portable bearer token, so that an attacker who obtains one leaked download key can repeatedly download a role- or password-protected package file without authorization.