CVE-2024-11768 is an improper authorization vulnerability (CWE-285) in the codename065 Download Manager WordPress plugin. The flaw exists in the checkFilePassword function, which fails to properly validate passwords protecting downloadable content. This allows unauthenticated attackers to bypass password protections and download files that should be restricted. The vulnerability affects all versions up to and including 3.3.03. The CVSS 3.1 base score is 5.3, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and limited confidentiality impact.

An attacker can download files that are intended to be protected by passwords without authentication, potentially exposing sensitive or restricted content. The impact is limited to confidentiality loss; integrity and availability are not affected. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling the Download Manager plugin or restricting access to it through other means to prevent unauthorized downloads. Monitor vendor channels for updates or patches addressing this vulnerability.