Download Manager WordPress Plugin Missing Authorization Vulnerability Allows Password Disclosure for Protected Media

A vulnerability exists in the Download Manager plugin for WordPress, affecting all versions up to and including 3.3.32. The issue arises from inadequate authorization and capability checks on the 'wpdm_media_access' AJAX action. This flaw enables authenticated attackers with Subscriber-level access and above to access passwords and access control settings for protected media attachments. Such information can be exploited to circumvent media protection and download restricted files.

Impact

Exploitation of this vulnerability could lead to unauthorized access to passwords and access control settings for protected media attachments, allowing restricted files to be downloaded.

Reproduction

To reproduce this vulnerability, an authenticated user with Subscriber-level access or higher can send a request to the 'wpdm_media_access' AJAX action. This request can include the ID of a media attachment that is protected. The absence of proper authorization checks will allow the user to retrieve the password and access settings for that attachment, which can then be used to download the file, bypassing the intended restrictions.

Remediation

Users are advised to update the Download Manager plugin to version 3.3.33 or a newer patched version.