CVE-2026-16608
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk10th percentile - higher than 10% of all known CVEs
Summary
The Download Monitor WordPress plugin before version 5.2.6 does not perform authorization checks on one of its download-logging AJAX actions and exposes the nonce protecting it to unauthenticated visitors. This allows unauthenticated users to inject arbitrary download log entries and inflate a site's download statistics.
Risk Assessment
The risk is manipulation of download statistics, potentially leading to false analytical data and loss of report credibility.
Recommendation
Update the Download Monitor plugin to version 5.2.6 or later, which includes authorization fixes.
Other vulnerabilities in Download Monitor WordPress plugin
See all- CVE-2026-112207Unknown
The Download Monitor WordPress plugin before version 5.3.4 does not properly validate that a clicked link belongs to the site before fetching it client-side and rendering part of the response in the page. This allows unauthenticated attackers to execute arbitrary JavaScript in the browser of any user who is tricked into clicking a crafted link.
- CVE-2026-112219Medium
The Download Monitor WordPress plugin before 5.3.5 does not correctly restrict management of the list of filesystem locations it may serve files from to network administrators on multisite. A subsite administrator not trusted at the network level can approve arbitrary locations, causing the plugin to serve readable files from outside the uploads directory, including files belonging to other subsites, to unauthenticated visitors. Single-site installations are unaffected.
Original NVD description (English source)
The Download Monitor WordPress plugin before 5.2.6 does not perform authorization checks on one of its download-logging AJAX actions, and exposes the nonce protecting it to unauthenticated visitors, allowing unauthenticated users to inject arbitrary download log entries and inflate a site's download statistics.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS