CVE-2026-16608
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk8th percentile - higher than 8% of all known CVEs
Summary
The Download Monitor WordPress plugin before version 5.2.6 does not perform authorization checks on one of its download-logging AJAX actions and exposes the nonce protecting it to unauthenticated visitors. This allows unauthenticated users to inject arbitrary download log entries and inflate a site's download statistics.
Risk Assessment
The risk is manipulation of download statistics, potentially leading to false analytical data and loss of report credibility.
Recommendation
Update the Download Monitor plugin to version 5.2.6 or later, which includes authorization fixes.
Original NVD description (English source)
The Download Monitor WordPress plugin before 5.2.6 does not perform authorization checks on one of its download-logging AJAX actions, and exposes the nonce protecting it to unauthenticated visitors, allowing unauthenticated users to inject arbitrary download log entries and inflate a site's download statistics.