Download Monitor CVE Vulnerabilities — WordPress Plugin Exploits

Download Monitor <= 5.1.9 - Authenticated (Author+) Arbitrary File Download

medium ✓ patched

cve id CVE-2026-39489 ↗

cvss score 4.3

cwe CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

published Apr 20, 2026

The Download Monitor plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 5.1.9. This makes it possible for authenticated attackers, with Author-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.

Download Monitor <= 5.1.10 - Cross-Site Request Forgery to Download Path Deletion and Disabling

medium ✓ patched

cve id CVE-2026-4401 ↗

cvss score 5.4

cwe CWE-352: Cross-Site Request Forgery (CSRF)

published Apr 7, 2026

The Download Monitor plugin for WordPress is vulnerable to Cross-Site Request Forgery in the `actions_handler()` and `bulk_actions_handler()` methods in `class-dlm-downloads-path.php` in all versions up to, and including, 5.1.10. This is due to missing nonce verification on these functions. This makes it possible for unauthenticated attackers to delete, disable, or enable approved download paths via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

Download Monitor <= 5.1.7 - Insecure Direct Object Reference to Unauthenticated Arbitrary Order Completion via 'token' and 'order_id'

high ✓ patched

cve id CVE-2026-3124 ↗

cvss score 7.5

cwe CWE-639: Authorization Bypass Through User-Controlled Key

published Mar 29, 2026

The Download Monitor plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.1.7 via the executePayment() function due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to complete arbitrary pending orders by exploiting a mismatch between the PayPal transaction token and the local order, allowing theft of paid digital goods by paying a minimal amount for a low-cost item and using that payment token to finalize a high-value order.

Download Monitor <= 5.1.8 - Authenticated (Contributor+) SQL Injection

medium ✓ patched

cve id CVE-2026-39486 ↗

cvss score 6.5

cwe CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

published Mar 25, 2026

The Download Monitor plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 5.1.8 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

Download Monitor <= 5.0.22 - Authenticated (Contributor+) Local File Inclusion

high ✓ patched

cve id CVE-2025-47439 ↗

cvss score 8.8

cwe CWE-98: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')

published May 7, 2025

The Download Monitor plugin for WordPress is vulnerable to Local File Inclusion via the get_template_part() function in versions up to, and including, 5.0.22. This makes it possible for authenticated attackers, with contributor-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.