CVE-2026-92714 is an Insecure Direct Object Reference vulnerability (CWE-639) in the Download Manager plugin for WordPress by codename065. The duplicate() function, triggered on admin_init, only verifies a generic 'edit_posts' capability and a static nonce, lacking object-level authorization against the targeted package ID. This flaw enables authenticated users with Author or higher privileges to duplicate any Download Manager package, including those owned by administrators, copying all metadata and restrictions. Attackers can then edit the cloned package to bypass role-based access controls and password protections, gaining unauthorized access to protected files.

Authenticated users with Author-level or higher privileges can bypass object-level authorization controls to duplicate and modify arbitrary Download Manager packages owned by other users, including administrators. This leads to unauthorized access to protected files and metadata, potentially exposing sensitive content that was intended to be restricted. The vulnerability does not affect confidentiality of the original packages but allows attackers to create clones without restrictions.

No official patch or fix is currently documented. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict Author-level access and above to trusted users only. Monitor for updates from codename065 regarding a security update addressing this vulnerability.