CVE-2026-103964: CWE-200 Exposure of Sensitive Information to an Unauthorized Actor in codename065 Download Manager

CVE-2026-103964 is a sensitive information exposure vulnerability in the codename065 Download Manager WordPress plugin affecting all versions up to 3.3.71. The flaw arises from the handling of the 'first_name' parameter in the suspension email template, which is compiled and sent synchronously during an administrator's authenticated HTTP request when suspending a user account. This process exposes the administrator's full Cookie header, including wordpress_logged_in_* session cookies, to an attacker with subscriber-level privileges or higher, enabling potential session hijacking and account takeover.

An attacker with subscriber-level or higher access can trick an administrator into suspending their account, causing the administrator's session cookies to be leaked via the suspension email. This leakage allows the attacker to hijack the administrator's session and potentially take over the administrator account. The vulnerability does not impact confidentiality beyond the exposed cookies, nor does it affect integrity or availability directly. The CVSS score is 4.3 (medium severity).

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should avoid suspending accounts of untrusted users or those suspected of exploiting this vulnerability. Monitoring for suspicious suspension actions and limiting subscriber privileges may reduce risk. Follow vendor updates for official patches or mitigations.