{"affected":[{"defaultStatus":"unaffected","product":"Download Manager","source":"CNA: WPScan","vendor":"Unknown","versions":[{"lessThan":"3.3.73","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"Download Manager","source":"CNA: WPScan","vendor":"Unknown","versions":[{"lessThan":"7.6.2","status":"affected","version":"4.0.0","versionType":"semver"}]}],"cveId":"CVE-2026-110949","cwes":["CWE-284"],"description":"The Download Manager WordPress plugin before 3.3.73, Download Manager WordPress plugin before 7.6.2 does not verify a package's configured role restriction when validating a package password, allowing an unauthenticated user who knows the password of a role-restricted package to obtain a download key and download the protected file.","epss":null,"exploits":[{"kind":"exploit","source":"CNA: WPScan","url":"https://wpscan.com/vulnerability/2ee629f0-d410-4272-991c-1eb6001fceb4/"}],"kev":null,"metrics":[],"modifiedAt":1794376806520,"publishedAt":1794376806520,"references":[{"source":"CNA: WPScan","tags":["exploit","vdb-entry","technical-description"],"url":"https://wpscan.com/vulnerability/2ee629f0-d410-4272-991c-1eb6001fceb4/"}],"remediation":[],"revision":"0dbc3685156a3fd91c0c62f5e83b981699d17d4abeb0425d9d27f92eee4cd78f","sources":[{"modifiedAt":1794376806520,"name":"CNA: WPScan","retrievedAt":1794377318140,"url":"https://www.cve.org/CVERecord?id=CVE-2026-110949"}],"ssvc":null,"status":"published","title":"Download Manager (Free & Pro) - Unauthenticated Missing Authorization via Password Validation","updatedAt":1794377318140}