CVE-2026-103964 json
Download Manager <= 3.3.71 - Authenticated (Subscriber+) Sensitive Information Exposure via Email Template Token Injection in 'first_name' Profile Field Token Injection into Suspension Email
published 30d ago modified 27d ago also EUVD-2026-96061
- cvss
- 4.3
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.2%
- EPSS 0.2% chance of exploitation in 30 days, percentile 15%
- public exploits
- 0
- none known
Summary
The Download Manager plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.3.71 via the 'first_name' parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to extract the administrator's full Cookie header, including wordpress_logged_in_* session cookies, from the suspension email sent during the administrator's authenticated request, enabling full session hijack and account takeover. Exploitation requires an administrator to perform the Suspend action against the attacker's account, which causes the plugin to synchronously compile and send the suspension email inside the administrator's authenticated HTTP request — making the administrator's session cookies available to the template engine at send time.
Is CVE-2026-103964 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerCISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 29d ago
Exploit prediction
0.24% chance of exploitation in the next 30 days, higher than 15% of all scored CVEs (FIRST EPSS, 2026-11-09).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 4.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N |
Affected products
- codename065 Download Manager
Classification
- Weakness
-
- CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
- Technology feeds
References
- wordfence.com /threat-intel/vulnerabilities/id/84791a83-197b-4a73-826d-517bf47bc5c9?source=cve
- plugins.trac.wordpress.org /browser/download-manager/tags/3.3.71/src/__/Email.php#L533
- plugins.trac.wordpress.org /browser/download-manager/tags/3.3.71/src/__/Email.php#L383
- plugins.trac.wordpress.org /browser/download-manager/tags/3.3.71/src/__/Email.php#L382
- plugins.trac.wordpress.org /browser/download-manager/tags/3.3.71/src/User/UserController.php#L180
- plugins.trac.wordpress.org /browser/download-manager/tags/3.3.71/src/User/UserController.php#L151
- plugins.trac.wordpress.org /browser/download-manager/
- plugins.trac.wordpress.org /changeset/3724472/download-manager/trunk/src/__/Email.php
Sources
- CVE List CVE-2026-103964
- NVD CVE-2026-103964
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.