CVE-2026-112219
MediumCVSS 4.9Exploitation Probability (EPSS)
Low risk6th percentile - higher than 6% of all known CVEs
Summary
The Download Monitor WordPress plugin before 5.3.5 does not correctly restrict management of the list of filesystem locations it may serve files from to network administrators on multisite. A subsite administrator not trusted at the network level can approve arbitrary locations, causing the plugin to serve readable files from outside the uploads directory, including files belonging to other subsites, to unauthenticated visitors. Single-site installations are unaffected.
Risk Assessment
A subsite administrator can expose files from across the server, including other subsites' data, to unauthenticated users. This is a serious data disclosure risk in multisite environments.
Recommendation
Update the Download Monitor plugin to version 5.3.5 or later. On multisite, review who holds subsite administrator privileges.
Other vulnerabilities in Download Monitor WordPress plugin
See all- CVE-2026-112207Unknown
The Download Monitor WordPress plugin before version 5.3.4 does not properly validate that a clicked link belongs to the site before fetching it client-side and rendering part of the response in the page. This allows unauthenticated attackers to execute arbitrary JavaScript in the browser of any user who is tricked into clicking a crafted link.
- CVE-2026-16608Medium
The Download Monitor WordPress plugin before version 5.2.6 does not perform authorization checks on one of its download-logging AJAX actions and exposes the nonce protecting it to unauthenticated visitors. This allows unauthenticated users to inject arbitrary download log entries and inflate a site's download statistics.
Original NVD description (English source)
The Download Monitor WordPress plugin before 5.3.5 does not correctly restrict management of the list of filesystem locations it may serve files from to network administrators on multisite, allowing a subsite administrator who is not trusted at the network level to approve arbitrary locations and have the Download Monitor WordPress plugin before 5.3.5 serve readable files from outside the uploads directory, including files belonging to other subsites, to unauthenticated visitors; single-site installations are unaffected.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS