Quick answers
- Is CVE-2026-16608 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-16608 being exploited in the wild.
- How severe is CVE-2026-16608?
- Medium severity, with a CVSS score of 5.3, published 8 August 2026.
- Which products and versions are affected?
- Ironistic Download Monitor before 5.2.6.
- Is there a fix for CVE-2026-16608?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-16608 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-16608?
- Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is a broken access control flaw (CWE-862) in an AJAX action that logs downloads. The plugin exposes a WordPress nonce (anti-CSRF token) to unauthenticated visitors in an HTTP response header, then fails to validate authorization on the log_dlm_xhr_download AJAX action. An attacker can obtain the nonce by making a standard download request with a specific header, then replay it to inject arbitrary log entries without authentication. The impact is limited to data integrity (inflated download counts), not code execution or confidential data exposure. The vulnerability is patched in version 5.2.6.
Affected products
- Ironistic Download Monitor before 5.2.6
Timeline
- 2026-08-03: disclosed
- 2026-08-08: advisory