CVE-2024-11768

Download manager <= 3.3.03 - Improper Authorization to Unauthenticated Download of Password-Protected Files

The Download Manager plugin for WordPress is vulnerable to unauthorized download of password-protected content due to improper password validation on the checkFilePassword function in all versions up to, and including, 3.3.03. This makes it possible for unauthenticated attackers to download password-protected files.

We have discovered 11,159 live websites that are affected by CVE-2024-11768.

Run a Free Instant Scan



Affected Software

Product  Download Manager
Category Wordpress Plugins
Vulnerable Domains11,159 live websites (33% of Download Manager install base)
Vulnerable Versions
  • from 0 through 3.3.3
Vulnerable Versions Count201 versions ( 81% of all versions)


Common Weakness Enumeration

CWE-285 Improper Authorization



Details

  • Published - Dec 19, 2024
  • Updated - Apr 8, 2026

Credits

  • Emiliano Versini (finder)

Website Distribution by Country

Number of websites using CVE-2024-11768
United States1,972 websites


Japan1,406 websites
Germany1,132 websites
Italy1,090 websites
France532 websites
Spain426 websites
GB376 websites
Russia281 websites
Poland232 websites
Brazil223 websites

Website Distribution by TLD

Number of websites using CVE-2024-11768
.com3,684 websites
.org863 websites
.it739 websites
.de653 websites
.net356 websites
.jp334 websites
.ru225 websites
.fr218 websites
.eu201 websites
.co.jp196 websites

Vulnerable Versions

Vulnerable versions are highlighted in red

Websites affected by CVE-2024-11768

Top websites that are affected by CVE-2024-11768. Please click on the "Contact us" link to get more information.
DomainCountryRankContacts
*****.pl Poland*,***
****.pt Portugal**,***
*****.org United States**,***
**********.com United States**,***
********.org United States**,***
*****.***.br Brazil**,***
*********.com Japan**,***
***********************.org United States**,***
*********.org United States***,***
*************.com United States***,***
See full domain list

FAQ

CVE-2024-11768 is Improper Authorization in Download Manager
A total of 11,159 websites have been identified as vulnerable to CVE-2024-11768, based on global website indexing conducted by WebTechSurvey.
The Download Manager is affected by the CVE-2024-11768 vulnerability.
Download Manager versions up to and including 3.3.3 are vulnerable to CVE-2024-11768.