CVE-2026-86611
UNKNOWN
NVD
CVSS Score
0
Severity
UNKNOWN
Published
Oct 21, 2026
Vendor
unknown
Description
The Download Manager WordPress plugin before 3.3.71, Download Manager WordPress plugin before 7.5.9 does not have CSRF checks in some places, allowing attackers to make a logged in admin update its privacy and storage settings via a crafted link, including the credential that gates its unauthenticated maintenance endpoint.