CVE-2026-39486
HighCVSS 8.5Exploitation Probability (EPSS)
Low risk17th percentile - higher than 17% of all known CVEs
Summary
The Download Monitor plugin for WordPress up to version 5.1.8 has a blind SQL injection vulnerability due to improper neutralization of special elements in SQL commands.
Risk Assessment
The risk is blind SQL injection, potentially allowing an attacker to extract sensitive data from the WordPress database.
Recommendation
Immediately update the Download Monitor plugin to a version later than 5.1.8.
Other vulnerabilities in Download Monitor
See all- CVE-2026-39489Medium
In Download Monitor versions <= 5.1.9, there is a vulnerability that allows unauthorized users to download arbitrary files.
- CVE-2026-4401Medium
The Download Monitor plugin for WordPress up to version 5.1.10 is vulnerable to Cross-Site Request Forgery (CSRF) in the actions_handler() and bulk_actions_handler() functions. Missing nonce verification allows an unauthenticated attacker to delete, disable, or enable approved download paths via a forged request, provided they trick an administrator into clicking a link.
Original NVD description (English source)
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WP Chill Download Monitor download-monitor allows Blind SQL Injection.This issue affects Download Monitor: from n/a through <= 5.1.8.