Unrated severityNVD Advisory· Published Dec 19, 2024· Updated Apr 8, 2026

Download manager <= 3.3.03 - Improper Authorization to Unauthenticated Download of Password-Protected Files

CVE-2024-11768

Description

The Download Manager plugin for WordPress is vulnerable to unauthorized download of password-protected content due to improper password validation on the checkFilePassword function in all versions up to, and including, 3.3.03. This makes it possible for unauthenticated attackers to download password-protected files.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

WordPress/Download Managerllm-fuzzy
Range: <=3.3.03
Package: https://wordpress.org/plugins/download-manager
codename065/Download Managerv5
Range: 0

Patches

Vulnerability mechanics

References

plugins.trac.wordpress.org/browser/download-manager/trunk/src/__/Apply.phpmitre
www.wordfence.com/threat-intel/vulnerabilities/id/feb915f4-66d6-4f46-949c-5354e414319bmitre

News mentions

No linked articles in our index yet.

cvss	0.000
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000