The Download Manager plugin for WordPress (codename065) suffers from a missing authorization vulnerability (CWE-862) in the wpdm_media_access AJAX action. This flaw allows authenticated users with low-level privileges (Subscriber and above) to retrieve sensitive data including passwords and access control settings for protected media attachments. Exploiting this vulnerability can lead to bypassing intended media protection mechanisms and unauthorized downloading of restricted files. The CVSS v3.1 base score is 4.3, indicating medium severity. No patch or official remediation has been documented as of the published date.

An attacker with authenticated Subscriber-level access can obtain sensitive information related to media protection, such as passwords and access control settings. This can lead to unauthorized access and downloading of protected media files, violating confidentiality. There is no indication of impact on integrity or availability. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Subscriber-level access to trusted users only and monitor for suspicious activity related to media downloads. Avoid granting unnecessary privileges to low-level users. Follow updates from the plugin vendor for any forthcoming patches or official mitigations.