Executive brief
Download Monitor is a WordPress plugin used to track and manage file downloads on a website. The plugin fails to properly verify user permissions on a download-logging feature, allowing anyone to inject fake download records and artificially inflate download statistics that site administrators rely on for reporting and analytics.
Technical details
The vulnerability is a broken access control flaw (CWE-862) in an AJAX action that logs downloads. The plugin exposes a WordPress nonce (anti-CSRF token) to unauthenticated visitors in an HTTP response header, then fails to validate authorization on the log_dlm_xhr_download AJAX action. An attacker can obtain the nonce by making a standard download request with a specific header, then replay it to inject arbitrary log entries without authentication. The impact is limited to data integrity (inflated download counts), not code execution or confidential data exposure. The vulnerability is patched in version 5.2.6.
Affected products
- Ironistic Download Monitor before 5.2.6
Timeline
- 2026-08-03: disclosed
- 2026-08-08: advisory