CVE-2026-4401
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk6th percentile - higher than 6% of all known CVEs
Summary
The Download Monitor plugin for WordPress up to version 5.1.10 is vulnerable to Cross-Site Request Forgery (CSRF) in the actions_handler() and bulk_actions_handler() functions. Missing nonce verification allows an unauthenticated attacker to delete, disable, or enable approved download paths via a forged request, provided they trick an administrator into clicking a link.
Risk Assessment
An attacker can manipulate download paths, potentially leading to unauthorized file access or disruption of plugin functionality.
Recommendation
Immediately update the Download Monitor plugin to the latest available version that fixes this vulnerability.
Original NVD description (English source)
The Download Monitor plugin for WordPress is vulnerable to Cross-Site Request Forgery in the `actions_handler()` and `bulk_actions_handler()` methods in `class-dlm-downloads-path.php` in all versions up to, and including, 5.1.10. This is due to missing nonce verification on these functions. This makes it possible for unauthenticated attackers to delete, disable, or enable approved download paths via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.