WordPress Download Manager has released version 7.5.9 today, 2 October 2026, with a batch of security fixes affecting email templates, login forms, protected downloads and plugin settings.
The developer’s official changelog lists several vulnerabilities addressed in the release, including sensitive information exposure through email templates, stored cross-site scripting in the login-form shortcode, cross-site request forgery on the settings screen, unauthorised access to protected files through the captcha lock and stored XSS through package icon URLs.
For UK businesses using WordPress Download Manager to distribute documents, customer files, gated resources or paid downloads, this is the kind of update that should not be left sitting in the dashboard for weeks. Several of the fixes relate directly to how user-supplied data, administrator settings and protected files are handled.
One of the more serious issues involved email template tokens. According to the developer, specially crafted values entered into profile fields could previously be interpreted rather than treated as plain text, potentially exposing sensitive administrator session information in account emails. Version 7.5.9 changes that behaviour so the values are printed safely.
The update also sanitises the regurl attribute used by the login form shortcode, strengthens nonce and administrator checks on settings changes, restricts captcha download keys to packages a visitor is actually allowed to access, and escapes package icon data before output.
Businesses running the plugin should first confirm they have a recent backup, then update to version 7.5.9 and test any download forms, protected resources, login flows and customer account areas. Sites with more complex integrations should ideally test the change on a staging copy before pushing it live.
Core Web UK’s website maintenance and support service covers controlled WordPress updates, backups and post-update checks for business websites. For sites where suspicious behaviour is already visible, the steps in our WordPress security recovery coverage explain what to preserve and check before making rushed changes.
The important distinction is that 7.5.9 is not simply a feature release. Its changelog is explicitly marked as a security release dated 2 October, so businesses using an older version should treat the update as a priority rather than routine housekeeping.
