CVE-2024-11768: w3eden Download Manager

Medium severity, CVSS 5.3. EPSS: 0.3% chance of exploitation in the next 30 days.

The Download Manager plugin for WordPress is vulnerable to unauthorized download of password-protected content due to improper password validation on the checkFilePassword function in all versions up to, and including, 3.3.03. This makes it possible for unauthenticated attackers to download password-protected files.

Affected products

• w3eden Download Manager: before 3.3.04 (fixed in 3.3.04)

Published 2024-12-19. Last modified 2026-06-17.