CVE-2023-6421 is a high severity flaw in the Download Manager plugin for WordPress. Before version 3.2.83, the plugin leaks a protected download password when it receives an invalid one. Update to 3.2.83 or later, and change any download passwords you rely on.
What's affected
- Product: Download Manager from W3 Eden, a WordPress plugin (free edition in the record).
- Affected: versions before 3.2.83, per the record.
- Fixed: 3.2.83.
- Exposure: the download password is returned when someone submits a wrong one.
The record gives a CVSS 3.1 base score of 7.5 (high) with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. The CISA Known Exploited Vulnerabilities flag in the record is false. This post does not claim exploitation in the wild.
How to check if you're exposed
wp plugin list --fields=name,status,version
Find the plugin in the output and compare its version with the affected range above. If you do not use wp-cli, open the Plugins screen in the WordPress admin and read the version shown under the plugin name.
What to do now
- Update Download Manager to 3.2.83 or later.
- Change the password on every protected download, since earlier ones may have leaked.
- Review which files are behind a password and whether any should not be public at all.
- Check web logs for repeated requests with wrong passwords to the same download.
- Run the free in-browser dependency scan at gold.safeguard.sh/scan on any project you build that bundles this component, and keep the result next to your inventory.
Why it matters
The record maps this issue to CWE-522 (Insufficiently Protected Credentials): A password or secret is stored or sent in a way that lets someone other than its owner obtain it.
The record classes this as insufficiently protected credentials. A password check should reveal only a pass or fail. Here a failed attempt returns the secret itself, so the check gives the answer away.
The attack needs no account and no special position, which explains the high confidentiality rating. The files behind the password are the real asset. If they are paid content or internal documents, assume that anyone could have fetched them before the update and rotate the passwords.
Quick check
Do I need to change passwords after updating?
Yes, if the downloads were exposed. A leaked password stays valid until you change it.
Is the paid Pro edition affected?
The record lists the free edition. Check the vendor notes for other editions.
Sources
These are the references listed in the NVD record for this CVE. They were not fetched when this post was written, so confirm fixed versions in the advisory before acting.
Last reviewed: 19 October 2026.
