Published October 21, 2026. Based on public reports available on that date; details may change.
CVE-2026-86611 is a cross-site request forgery issue in Download Manager Free before 3.3.71 and Download Manager Pro before 7.5.9. A crafted link can cause a logged-in administrator to alter privacy and storage settings, including a credential used by the unauthenticated maintenance endpoint. Update both editions past the affected versions and keep administrators away from untrusted links.
What happened
Cross-site request forgery, commonly called CSRF, is a problem where a browser that is already signed in can be made to send an unwanted request. The administrator may not intend to change anything, but a crafted link can ask the site to perform an action using that administrator's existing session.
For this issue, the reported actions can alter Download Manager privacy and storage settings. The public description also notes a credential used by an unauthenticated maintenance endpoint. Those are configuration details worth checking after the update, because a setting change can remain in place even after the software is patched.
The cited public records do not report exploitation in the wild. They do not say that every Download Manager configuration has changed. Update promptly, review the relevant settings carefully, and avoid treating an unexpected link as harmless just because it opens in a browser.
Who is affected
Download Manager Free versions before 3.3.71 are affected. Download Manager Pro versions before 7.5.9 are affected. The fixed versions named in the public record are 3.3.71 for Free and 7.5.9 for Pro, so update each edition to that version or a later release.
In the WordPress dashboard, select Plugins and identify which edition your site uses. Record the plugin name and installed version before updating. If your organization has a public site and a separate portal or file-download site, inventory both. Sites maintained by a different team can easily be missed.
From the WordPress installation directory, this command lists plugins and versions:
wp plugin list --format=table
Save the result before and after the change. It provides a basic maintenance record and helps verify that an update happened on the server you meant to update. If you use both Free and Pro on different sites, check the correct fixed version for each one.
How to check administrative exposure
The immediate concern is a logged-in administrator following a crafted link. Ask people with Administrator access not to open unexpected links from email, chat, browser notifications, or support requests while their WordPress session is active. Use a saved bookmark or enter the known dashboard address directly when you need to sign in.
Then open the Download Manager settings through the ordinary WordPress dashboard and review privacy and storage configuration. Compare the current values with your documented intended settings, if you have them. Confirm the credential used by the unauthenticated maintenance endpoint is expected and handled according to your own access process. If you cannot confirm a setting or credential, reset it through the supported administration workflow.
Review the administrator list too. In the dashboard, choose Users and confirm every Administrator account belongs to someone who currently needs access. This command lists those accounts from WP-CLI:
wp user list --role=administrator --fields=ID,user_login,user_email,user_registered --format=table
Unknown accounts or unexplained settings are not proof that this vulnerability was used. They are, however, reasons to preserve relevant logs and examine the site more closely. Our guide to finding hidden WordPress admin users can help with the account review.
What to do now
Take a current backup of the WordPress files and database, then update the affected Download Manager edition. In Plugins, use the update control and confirm Free is at 3.3.71 or later, or Pro is at 7.5.9 or later. Test ordinary download behavior and the intended privacy controls after updating.
If you manage the site through WP-CLI, begin by identifying available plugin updates:
wp plugin list --update=available --format=table
After a tested backup, wp plugin update --all updates all plugins that have releases available. It is not limited to Download Manager, so use it only when it matches your change-management process. Run wp plugin list --format=table again and confirm the edition on the site is at its stated fixed version or later.
Keep all administrators cautious about links and remove access that is no longer required. Review your routine against the WordPress hardening checklist, including plugin updates and account access. If the site has broader warning signs such as unexplained configuration changes or unknown users, the steps in how to fix a hacked WordPress site provide a more complete response sequence.
When to get help
Get help if you cannot confirm the intended privacy, storage, or maintenance settings, or if you suspect an administrator followed a malicious link. A security audit can review the configuration, and WordPress hardening can help reduce future administrative exposure.