Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
The Download Manager plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'reviewUserStatus' function in all versions up to, and including, 3.3.49. This makes it possible for authenticated attackers, with Subscriber-level access and above, to retrieve sensitive information for any user on the site including email addresses, display names, and registration dates.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
STABLE
CVE-2026-2571 The Download Manager plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'reviewUserStatus' function in all versi… https://www.cve.org/CVERecord?id=CVE-2026-2571
Post summary
A new CVE (2026‑2571) identifies a missing capability check in the Download Manager WordPress plugin, allowing unauthorized data access.
CVE-2026-2571 WordPress Download Manager Plugin Information Disclosure via Unauthorized User Status Retrieval https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-2571
Post summary
The post announces CVE-2026-2571, an information‑disclosure issue in the WordPress Download Manager plugin that allows unauthorized users to retrieve user status, but it does not provide a PoC, exploit details, or patch information.