CVE-2026-39489
MediumCVSS 4.4Exploitation Probability (EPSS)
Low risk25th percentile - higher than 25% of all known CVEs
Summary
In Download Monitor versions <= 5.1.9, there is a vulnerability that allows unauthorized users to download arbitrary files.
Risk Assessment
An attacker could exploit this vulnerability to access sensitive files, potentially leading to data leakage within the organization.
Recommendation
It is recommended to update Download Monitor to the latest version to mitigate this vulnerability.
Other vulnerabilities in Download Monitor
See all- CVE-2026-39486High
The Download Monitor plugin for WordPress up to version 5.1.8 has a blind SQL injection vulnerability due to improper neutralization of special elements in SQL commands.
- CVE-2026-4401Medium
The Download Monitor plugin for WordPress up to version 5.1.10 is vulnerable to Cross-Site Request Forgery (CSRF) in the actions_handler() and bulk_actions_handler() functions. Missing nonce verification allows an unauthenticated attacker to delete, disable, or enable approved download paths via a forged request, provided they trick an administrator into clicking a link.
Original NVD description (English source)
Author Arbitrary File Download in Download Monitor <= 5.1.9 versions.