WordPress Download Manager Privilege Escalation Vulnerability

A privilege escalation vulnerability has been identified in the Download Manager plugin for WordPress, affecting all versions through 3.3.40. The issue arises because the plugin fails to properly verify a user's identity before allowing password changes. This flaw enables unauthenticated attackers to reset passwords for non-administrator users, potentially leading to unauthorized access to their accounts.

Impact

Exploitation of this vulnerability allows for unauthorized password changes, enabling attackers to gain access to user accounts (excluding administrators).

Remediation

Users are advised to update the Download Manager plugin to version 3.3.41 or a newer patched version.