# CVE-2026-39489: WP Chill Download Monitor arbitrary file download in Author role

Source: https://junglewise.ai/threats/cve-2026-39489-wp-chill-download-monitor-arbitrary-file-download-in-author-role  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-15. Updated: 2026-06-15  
License: CC BY 4.0 with a link back

CVE-2026-39489 · Severity: medium · CVSS 4.4 · Published 2026-06-15

Download Monitor, a WordPress plugin used to manage and track file downloads, contains a security flaw that allows users with 'Author' level permissions to download sensitive files from the server. An attacker with these credentials could potentially access website configuration files, backup data, or other internal system files. This could lead to the exposure of database credentials and other private information, compromising the overall security of the website.

Technologies: [WP Chill Download Monitor](https://junglewise.ai/threats/technologies/download-monitor). Vendors: [WP Chill](https://junglewise.ai/threats/vendors/wp-chill).

## Quick answers

**Is CVE-2026-39489 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-39489 being exploited in the wild.

**How severe is CVE-2026-39489?** Medium severity, with a CVSS score of 4.4, published 15 June 2026.

**Which products and versions are affected?** WP Chill Download Monitor <= 5.1.9.

**Is there a fix for CVE-2026-39489?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-39489 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-39489?** Check whether you run WP Chill Download Monitor at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A path traversal vulnerability (CWE-22) exists in the Download Monitor plugin for WordPress in versions up to and including 5.1.9. The flaw allows an authenticated attacker with Author-level permissions to bypass intended directory restrictions and download arbitrary files from the underlying server. The vulnerability stems from improper limitation of a pathname to a restricted directory. While the attack requires high privileges (Author role) and has high complexity, a successful exploit results in a high confidentiality impact. The issue is resolved in version 5.1.10.

## Affected products

- WP Chill Download Monitor <= 5.1.9

## Timeline

- 2026-02-23: other: Reported by researcher daroo
- 2026-04-20: advisory: Patchstack advisory published
- 2026-06-15: disclosed: NVD publication date

## References

- [https://patchstack.com/database/wordpress/plugin/download-monitor/vulnerability/wordpress-download-monitor-plugin-5-1-9-non-arbitrary-file-download-vulnerability?_s_id=cve](https://patchstack.com/database/wordpress/plugin/download-monitor/vulnerability/wordpress-download-monitor-plugin-5-1-9-non-arbitrary-file-download-vulnerability?_s_id=cve)

## Related threats

- [WP Chill Download Monitor stored cross-site scripting](https://junglewise.ai/threats/cve-2026-110375-improper-neutralization-of-input-during-web-page-generation)
- [WP Chill Download Monitor SQL injection](https://junglewise.ai/threats/cve-2026-39486-wp-chill-download-monitor-sql-injection)