What is GHSA-4m9m-6fj5-4v23?

GHSA-4m9m-6fj5-4v23 is a security advisory published by GitHub Security Advisories with unknown severity. The Download Manager WordPress plugin before 3.3.62 does not bind its temporary download token to...

Which CVE IDs does GHSA-4m9m-6fj5-4v23 cover?

GHSA-4m9m-6fj5-4v23 covers the following CVE IDs: CVE-2026-14235. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

GHSA-4m9m-6fj5-4v23unknown

The Download Manager WordPress plugin before 3.3.62 does not bind its temporary download token to...

Vendor

GitHub Security Advisories

Published

July 27, 2026

Last Modified

July 27, 2026

🔗 CVE IDs covered (1)

CVE-2026-14235 →

📋 Description

The Download Manager WordPress plugin before 3.3.62 does not bind its temporary download token to the requesting session nor expire it promptly, making the token a long-lived, multi-use, portable bearer token, so that an attacker who obtains one leaked download key can repeatedly download a role- or password-protected package file without authorization.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-14235
https://wpscan.com/vulnerability/9634b51c-59a1-45f6-8b09-421d6bfd0204
https://github.com/advisories/GHSA-4m9m-6fj5-4v23