CVE-2026-86611: CWE-352 Cross-Site Request Forgery (CSRF) in Download Manager

CVE-2026-86611 describes a CSRF vulnerability in the Download Manager WordPress plugin. Versions before 3.3.71 and versions from 4.0.0 up to but not including 7.5.9 do not implement CSRF checks in some administrative functions. This flaw enables attackers to cause an authenticated admin user to unknowingly update sensitive settings such as privacy, storage, and credentials that control access to an unauthenticated maintenance endpoint. The vulnerability arises from missing CSRF tokens or validation in these update operations.

An attacker can exploit this vulnerability to manipulate administrative settings by leveraging a logged-in administrator's session. This can lead to unauthorized changes in privacy and storage configurations and potentially expose or weaken protections on an unauthenticated maintenance endpoint, increasing the risk of further unauthorized access or data exposure.

No explicit patch or fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is applied, administrators should avoid clicking on untrusted links while logged in and consider restricting administrative access or using additional security controls such as multi-factor authentication.