An improper access control vulnerability in the Download Manager WordPress plugin enables unauthenticated attackers to potentially access restricted resources.

The plugin suffers from improper access control (CWE-284), which can be triggered by an unauthenticated attacker. This flaw allows unauthorized interaction with the plugin's functionality, which may lead to the exposure of sensitive data or unauthorized file management.

The ability for unauthenticated parties to bypass access controls presents a significant threat to data confidentiality and integrity. Given the 7.5 CVSS score, this vulnerability could be leveraged to gain unauthorized access to protected downloads or sensitive site configurations, potentially leading to unauthorized data exfiltration.

Immediate Action: Update the Download Manager plugin to version 3.3.62 or the latest available release to resolve the access control deficiency.

Proactive Monitoring: Monitor access logs for unauthorized attempts to reach file download endpoints or administrative paths associated with the plugin.

Compensating Controls: Utilize a WAF to restrict access to the plugin's core endpoints, ensuring only authorized user roles can interact with sensitive plugin features.

Public Exploit Available: No (unknown)

Given the evidence of a proof-of-concept, the risk of exploitation is elevated. Organizations using this plugin must prioritize the update process to ensure that access controls are properly enforced and the attack surface is minimized.