PULSE
ES
FEED
ransomaurora reclama a Allmand-Smith Limited · GB · Manufacturingransomn0n reclama a Hanjin Information Systems & Telecommunication Co., Ltd. · KR · Technologyransominterlock reclama a Coastal Alabama Community College · US · Educationransomsilentransomgroup reclama a Porter Hedges LLP · US · Professional Servicesransomhelix reclama a Westrock Coffee · US · Retail & E-Commerceransomakira reclama a Flextron Circuit Assembly · SG · Manufacturingransomakira reclama a Cascade Flooring America · US · Retail & E-Commerceransomhelix reclama a Hypertherm · US · Manufacturingransomeverest reclama a PLD Group · Otherransomeverest reclama a Lindauer Dornier · DE · Manufacturingransomeverest reclama a Lanham Associates · Professional Servicesransompear reclama a Adobe Insurance Brokers, LLC · US · Financial Servicesransomhyflock reclama a gabonmeca.com leak incident · GA · Manufacturingransomhyflock reclama a dangvuongcac · VN · Not Foundransomaurora reclama a Allmand-Smith Limited · GB · Manufacturingransomn0n reclama a Hanjin Information Systems & Telecommunication Co., Ltd. · KR · Technologyransominterlock reclama a Coastal Alabama Community College · US · Educationransomsilentransomgroup reclama a Porter Hedges LLP · US · Professional Servicesransomhelix reclama a Westrock Coffee · US · Retail & E-Commerceransomakira reclama a Flextron Circuit Assembly · SG · Manufacturingransomakira reclama a Cascade Flooring America · US · Retail & E-Commerceransomhelix reclama a Hypertherm · US · Manufacturingransomeverest reclama a PLD Group · Otherransomeverest reclama a Lindauer Dornier · DE · Manufacturingransomeverest reclama a Lanham Associates · Professional Servicesransompear reclama a Adobe Insurance Brokers, LLC · US · Financial Servicesransomhyflock reclama a gabonmeca.com leak incident · GA · Manufacturingransomhyflock reclama a dangvuongcac · VN · Not Found
← All CVEs
CVE WatchOct 21, 2026

CVE-2026-86611

The Download Manager WordPress plugin before 3.3.71, Download Manager WordPress plugin before 7.5.9 does not have CSRF checks in some places

CVSS

—

No CVSS

EPSS

—

KEV

—

Exploit Today

0

0-100

Published: Oct 21, 2026 · Last modified: Oct 21, 2026

EPSS · 30d

Not enough EPSS history yet.

Technical description

The Download Manager WordPress plugin before 3.3.71, Download Manager WordPress plugin before 7.5.9 does not have CSRF checks in some places, allowing attackers to make a logged in admin update its privacy and storage settings via a crafted link, including the credential that gates its unauthenticated maintenance endpoint.

Official references
Related CVEs

No related CVEs by CWE or product.