WordPress Download Manager < 3.3.62 – Unauthorized Protected File Download via Reusable Download Key | CVE 2026-14235

Description

The plugin does not bind its temporary download token to the requesting session nor expire it promptly, making the token a long-lived, multi-use, portable bearer token, so that an attacker who obtains one leaked download key can repeatedly download a role- or password-protected package file without authorization.

Proof of Concept

Prerequisites: a Download Manager package restricted to a non-guest role (or password/captcha locked) containing a non-public file; a valid _wpdmkey for that package was minted in an authorized context (an authorized user passed the lock, or opened a preview) and the resulting download URL leaked to the attacker (via Referer, server/proxy/CDN logs, browser history on a shared machine, or a shared link).

1. Control: an unauthenticated request with no key is denied:
   curl -s "https://victim.example/?wpdmdl=<PID>"
   # => "You don't have permission to download this file"

2. Replay the leaked key from a fresh, unauthenticated, cookie-less session:
   curl -s "https://victim.example/?wpdmdl=<PID>&_wpdmkey=<LEAKED_KEY>" -o stolen_file
   # => HTTP 200, Content-Disposition: attachment; the protected file bytes are returned.

3. The same key works repeatedly (default ~10 uses, ~11.5-day lifetime) from any session/IP, confirming it is an unbound global bearer token (stored with deviceID='alldevice', looked up by token name only).

Note: this is NOT a from-zero unauthenticated bypass. The "brute-force/predictable key" framing does not hold (uniqid() is impractical to brute online and there is no default unauth path to mint a key for an arbitrary restricted package). The defect is that a token meant to be short-lived/session-scoped is a long-lived, portable, multi-use bearer token, so a single leaked URL grants far broader unauthorized access than intended. Reproduced on 3.3.57 and current 3.3.61.