Exploitation Research Plan - CVE-2026-39615 (Download Manager)

1. Vulnerability Summary

The Download Manager plugin (<= 3.3.53) is vulnerable to Stored Cross-Site Scripting (XSS) due to insufficient input sanitization and output escaping of package metadata. Specifically, the WPDM\Admin\Menu\Packages::savePackage method, which handles the saving of "Download" (wpdmpro) post metadata, contains logic that bypasses sanitization for certain fields like password and uses inadequate escaping (htmlspecialchars without ENT_QUOTES) for others like link_label. This allows an authenticated user with Author-level permissions or higher to inject malicious scripts into package metadata, which are subsequently rendered in the WordPress admin area or on the frontend package pages.

2. Attack Vector Analysis

• Endpoint: /wp-admin/post.php (for updating) or /wp-admin/post-new.php (for creating).
• Hook: save_post (which triggers WPDM\Admin\Menu\Packages::savePackage).
• Target Post Type: wpdmpro (Downloads).
• Vulnerable Parameters: file[password], file[link_label], file[version], file[package_size].
• Authentication: Authenticated Author+. The user must have edit_post capability for the package and the upload_files capability (standard for Authors).
• Preconditions: The plugin must be active, and the attacker must be able to create or edit a wpdmpro post.

3. Code Flow

1. Entry Point: When a user saves a wpdmpro post, WordPress fires the save_post action.
2. Hook Registration: In src/Admin/Menu/Packages.php, the __construct method registers the hook: add_action( 'save_post', array( $this, 'savePackage' ) );.
3. Capability Check: savePackage checks if the user can edit_post and upload_files (lines 47-49).
4. Metadata Iteration: The function iterates over the $_POST['file'] array (line 70).
5. Sanitization Bypass (Password):

   // src/Admin/Menu/Packages.php:75
   if ( $meta_key == 'password' ) {
       //don't alter/sanitize password
   }
   

   If the key is password, it hits an empty block, skipping the else block's htmlspecialchars sanitization. The raw input is then passed directly to update_post_meta (line 105).
6. Inadequate Sanitization (Other fields):

   // src/Admin/Menu/Packages.php:103
   else {
       $meta_value = is_array( $meta_value ) ? wpdm_sanitize_array( $meta_value, 'txt' ) : htmlspecialchars( $meta_value );
   }
   

   For other fields (e.g., link_label), it uses htmlspecialchars. By default (in PHP < 8.1), this does not escape single quotes ('), allowing attribute breakout if the value is rendered inside a single-quoted attribute (e.g., <input value='$label'>).
7. Sink: update_post_meta( $post, $key_name, $meta_value ); (line 105). The malicious script is stored in the database.
8. Execution: The payload executes when a user (admin or visitor) views the package in the backend list, editor, or frontend single package page.

4. Nonce Acquisition Strategy

This vulnerability exploits the standard WordPress post saving mechanism.

1. Requirement: A