CVE-2023-1524

The Download Manager plugin for WordPress through version 3.2.7.0 contains an information disclosure vulnerability stemming from inadequate password validation on protected files. An authenticated attacker with access to the downloads area can exploit this by creating a password-protected post that reveals a master key, which can then be combined with the original password to gain unauthorized access to all other password-protected posts.

Based on public CVE data (MITRE/NVD).