Download Manager Missing Capability Check Vulnerability Allowing Email Enumeration

A vulnerability exists in the Download Manager plugin for WordPress, in all versions through 3.3.49. The issue arises from a missing capability check in the 'reviewUserStatus' function, which allows authenticated users with Subscriber-level access and above to access sensitive information about other users. This includes email addresses, display names, and registration dates.

Impact

Exploitation of this vulnerability could lead to unauthorized access to user data, allowing attackers to enumerate email addresses and other personal information of users on the site.

Reproduction

To reproduce this vulnerability, an authenticated user with Subscriber-level access or higher can send a request to the 'wpdmdz_user_status' action via the admin-ajax.php file. The request must include a 'user' parameter specifying the ID of the user whose information is being requested. This can be done manually or through a script that automates the process.

Remediation

Users are advised to update the Download Manager plugin to version 3.3.50 or later.