# CVE-2026-39486: WP Chill Download Monitor SQL injection

Source: https://junglewise.ai/threats/cve-2026-39486-wp-chill-download-monitor-sql-injection  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-08. Updated: 2026-07-24  
License: CC BY 4.0 with a link back

CVE-2026-39486 · Severity: high · CVSS 8.5 · Published 2026-04-08

WP Chill Download Monitor is a WordPress plugin used to manage and track file downloads on websites. A security vulnerability in versions 5.1.8 and earlier allows an attacker with basic user permissions to perform a 'blind' SQL injection attack. This could lead to the unauthorized extraction of sensitive information from the website's database, potentially compromising user data or site configuration.

Technologies: [WP Chill Download Monitor](https://junglewise.ai/threats/technologies/download-monitor). Vendors: [WP Chill](https://junglewise.ai/threats/vendors/wp-chill).

## Quick answers

**Is CVE-2026-39486 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-39486 being exploited in the wild.

**How severe is CVE-2026-39486?** High severity, with a CVSS score of 8.5, published 8 April 2026.

**Which products and versions are affected?** WP Chill Download Monitor <= 5.1.8.

**Is there a fix for CVE-2026-39486?** A patch was published on 2026-05-19: Fixed in version 5.1.9 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-39486 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-39486?** Check whether you run WP Chill Download Monitor at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A Blind SQL Injection vulnerability exists in the WP Chill Download Monitor plugin for WordPress due to improper neutralization of special elements in SQL commands. The flaw is present in versions up to and including 5.1.8. An authenticated attacker with at least 'Contributor' level permissions can send specially crafted requests to the server to execute arbitrary SQL queries. Because it is a 'blind' injection, the attacker must infer data based on the application's response or timing rather than seeing the data directly. This can lead to full database disclosure. The issue is resolved in version 5.1.9.

## Affected products

- WP Chill Download Monitor <= 5.1.8

## Timeline

- 2026-02-23: other: Vulnerability reported by researcher daroo
- 2026-03-25: advisory: Patchstack published advisory and assigned PSID 925def0e9095
- 2026-04-08: disclosed: CVE-2026-39486 published
- 2026-05-19: patched: Fixed in version 5.1.9

## References

- [https://wordpress.org/plugins](https://wordpress.org/plugins)
- [https://patchstack.com/database/Wordpress/Plugin/download-monitor/vulnerability/wordpress-download-monitor-plugin-5-1-8-sql-injection-vulnerability?_s_id=cve](https://patchstack.com/database/Wordpress/Plugin/download-monitor/vulnerability/wordpress-download-monitor-plugin-5-1-8-sql-injection-vulnerability?_s_id=cve)

## Related threats

- [WP Chill Download Monitor stored cross-site scripting](https://junglewise.ai/threats/cve-2026-110375-improper-neutralization-of-input-during-web-page-generation)
- [WP Chill Download Monitor arbitrary file download in Author role](https://junglewise.ai/threats/cve-2026-39489-wp-chill-download-monitor-arbitrary-file-download-in-author-role)