‹ Back to list

CVE-2026-86611

Status: ReceivedUnscored—
Severity—Unscored
Exploitation probability—next 30 days
Active exploitationNonot in the CISA catalog
Public exploitNot knownno public code found

The Download Manager WordPress plugin before 3.3.71, Download Manager WordPress plugin before 7.5.9 does not have CSRF checks in some places, allowing attackers to make a logged in admin update its privacy and storage settings via a crafted link, including the credential that gates its unauthenticated maintenance endpoint.

CVSS

NVD hasn't assigned a CVSS score to this CVE (common since the April 2026 policy change).

Exploitation probability (EPSS)

FIRST hasn't scored this CVE yet (usual for very recent or rejected CVEs).

EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).

Affected technologies (1)

⚠ AI-inferred from the description — NVD hasn't analyzed this CVE yet, these aren't verified CPEs.

Download Manager — Download ManagerAI

References

Show 1 references

Raw JSON (NVD)

Show
{
  "id": "CVE-2026-86611",
  "cveTags": [],
  "metrics": {},
  "affected": [
    {
      "source": "contact@wpscan.com",
      "affectedData": [
        {
          "vendor": "Unknown",
          "product": "Download Manager",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "3.3.71",
              "versionType": "semver"
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "Unknown",
          "product": "Download Manager",
          "versions": [
            {
              "status": "affected",
              "version": "4.0.0",
              "lessThan": "7.5.9",
              "versionType": "semver"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2026-10-21T06:16:50.300",
  "references": [
    {
      "url": "https://wpscan.com/vulnerability/07ed3827-e52e-4021-91ed-511fc5f554ba/",
      "source": "contact@wpscan.com"
    }
  ],
  "vulnStatus": "Received",
  "descriptions": [
    {
      "lang": "en",
      "value": "The Download Manager WordPress plugin before 3.3.71, Download Manager WordPress plugin before 7.5.9 does not have CSRF checks in some places, allowing attackers to make a logged in admin update its privacy and storage settings via a crafted link, including the credential that gates its unauthenticated maintenance endpoint."
    }
  ],
  "lastModified": "2026-10-21T06:16:50.300",
  "sourceIdentifier": "contact@wpscan.com"
}