CVE-2026-86611— Download Manager (Free & Pro) - Privacy Settings Update via CSRF
Quick assessment
Affected
Unknown Download Manager
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在版本 3.3.71 之前的 Download Manager WordPress 插件，以及在版本 7.5.9 之前的 Download Manager WordPress 插件，在某些功能中缺乏跨站请求伪造（CSRF）检查。这使得攻击者能够利用精心构造的链接，诱使已登录的管理员更新其隐私和存储设置，其中包括用于保护其未认证维护端点的凭据。
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing ApplicationAffected Version Matrix 2
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Unknown | Download Manager | < 3.3.71 |
affected |
4.0.0< 7.5.9 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-86611
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Download Manager (Free & Pro) - Privacy Settings Update via CSRF
Source: CVE Program / CVE List V5
Vulnerability Description
The Download Manager WordPress plugin before 3.3.71, Download Manager WordPress plugin before 7.5.9 does not have CSRF checks in some places, allowing attackers to make a logged in admin update its privacy and storage settings via a crafted link, including the credential that gates its unauthenticated maintenance endpoint.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Unknown | Download Manager | 0 ~ 3.3.71 | - |
|
| Unknown | Download Manager | 4.0.0 ~ 7.5.9 | - |
|
II. Public POCs for CVE-2026-86611
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-86611
请登录查看更多情报信息。
Same Patch Batch · Unknown · 2026-10-21 · 53 CVEs total
| CVE-2026-85683 | 8.8 HIGH | Jane Menu < 1.5.1 - Unauthenticated Stored XSS via Store Config Proxy URL |
| CVE-2026-14556 | 5.4 MEDIUM | HappyForms < 1.26.15 - Unauthenticated HTML Injection in Admin Notification Email via clie |
| CVE-2026-107447 | 5.3 MEDIUM | Contest Gallery < 34.0.1 - Unauthenticated Vote Restriction Bypass via Spoofable Client-IP |
| CVE-2026-105256 | 5.3 MEDIUM | LatePoint < 5.7.5 - Unauthenticated Payment Bypass via 'payment_portion' Parameter |
| CVE-2026-104641 | 5.3 MEDIUM | Simple Shopping Cart < 5.3.3 - Unauthenticated Payment Bypass via Unverified PayPal IPN Re |
| CVE-2026-103301 | 5.3 MEDIUM | Payment Gateway for Telcell < 2.0.5 - Unauthenticated Payment Confirmation Forgery via Emp |
| CVE-2026-101138 | 5.3 MEDIUM | CMP - Coming Soon & Maintenance 4.1.19 - 4.1.20 - Unauthenticated Maintenance Mode Bypass |
| CVE-2026-104642 | 2.7 LOW | Simple Shopping Cart 5.1.3 - 5.3.2 - Contributor+ Price Manipulation via Price Verificatio |
| CVE-2026-105257 | LatePoint < 5.7.5 - Agent+ Customer PII Disclosure via IDOR | |
| CVE-2026-110514 | WPZOOM Portfolio < 1.4.34 - Contributor+ Arbitrary Post/Page Type Overwrite via IDOR | |
| CVE-2026-107127 | Uncanny Toolkit for LearnDash < 3.8.2 - Account Takeover via Password Reset CSRF | |
| CVE-2026-107128 | Uncanny Toolkit for LearnDash < 3.8.2 - Admin+ Cross-Site Account Lockout via Missing Auth | |
| CVE-2026-107788 | SmartyParcel (WC Ukr Shipping) < 1.23.4 - Subscriber+ Arbitrary Shipping Label Deletion | |
| CVE-2026-107790 | WP Job Openings < 4.1.1 - Author+ Stored XSS via Job Title | |
| CVE-2026-107789 | SmartyParcel < 1.23.4 - Unauthenticated Shipping Label Disclosure via IDOR | |
| CVE-2026-108073 | SureCart < 4.9.5 - Unauthenticated Private Catalog Data Disclosure via 'expand' Parameter | |
| CVE-2026-109147 | WP Booking System < 2.1.0.3 - Reflected XSS via 'booking_id' Parameter | |
| CVE-2026-109926 | Productive Commerce < 1.1.49 - Subscriber+ Arbitrary Plugin Activation | |
| CVE-2026-110523 | WP User Manager 2.9.21 - 2.9.25 - Unauthenticated Privilege Escalation via Paid Registrati | |
| CVE-2026-100145 | Synchrony Financing 1.0.5 - 1.1.1 - Unauthenticated Order Takeover via admin_order_callbac |
Showing top 20 of 53 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Download Manager
-
CVE-2026-12054
Download Manager <= 3.3.57 - Unauthenticated DOM-Based Refle -
CVE-2026-9696
Download Manager <= 3.3.58 - Authenticated (Contributor+) St -
CVE-2026-103964
Download Manager <= 3.3.71 - Authenticated (Subscriber+) Sen -
CVE-2026-102401
Download Manager <= 3.3.71 - Authenticated (Contributor+) St -
CVE-2026-94405
WordPress Download Manager plugin <= 3.3.71 - Sensitive Data
Same vendor: Unknown
-
CVE-2026-94268
Advanced Custom Fields: Extended 0.9.2.7 - Unauthenticated A -
CVE-2026-94262
Advanced Custom Fields: Extended 0.9.2.7 - Unauthenticated N -
CVE-2026-94264
Advanced Custom Fields: Extended 0.8.9.4 - 0.9.2.7 - Contrib -
CVE-2026-94267
Advanced Custom Fields: Extended < 0.9.2.8 - Unauthenticated -
CVE-2026-112219
Download Monitor < 5.3.5 - Multisite Subsite Admin+ Incorrec
V. Comments for CVE-2026-86611
No comments yet