Input validation vulnerability in Download Manager 2.9.45

The WordPress Download Manager plugin is vulnerable to a type of attack called Cross-Site Request Forgery. This means that in versions up to 2.9.45, attackers who can get a site administrator to click on a link may be able to make changes to the site’s settings without being logged in. This happens because the plugin is missing a type of security check called a nonce validation, which is designed to make sure that only authorized people can make changes.