Executive brief
The Download Monitor plugin for WordPress, which manages file downloads and tracking, is vulnerable to a security flaw that could allow unauthorized changes to download settings. By tricking a site administrator into clicking a malicious link, an attacker can remotely delete, enable, or disable approved download paths. This could lead to service disruptions or the removal of legitimate download links from the website.
Technical details
The Download Monitor plugin for WordPress (versions up to 5.1.10) is vulnerable to Cross-Site Request Forgery (CSRF) due to missing nonce verification in the `actions_handler()` and `bulk_actions_handler()` methods within `class-dlm-downloads-path.php`. An unauthenticated attacker can exploit this by inducing a site administrator to perform an action, such as clicking a link, which triggers a forged request. Successful exploitation allows the attacker to delete, disable, or enable approved download paths. The issue is addressed in version 5.1.11.
Affected products
- WPChill Download Monitor up to, and including, 5.1.10
Timeline
- 2026-04-08: disclosed
- 2026-04-08: advisory
- 2026-04-08: patched: Fixed in version 5.1.11
References
- https://plugins.trac.wordpress.org/browser/download-monitor/tags/5.1.8/src/Admin/DownloadPaths/class-dlm-downloads-path.php
- https://plugins.trac.wordpress.org/browser/download-monitor/tags/5.1.8/src/Admin/DownloadPaths/class-dlm-downloads-path.php
- https://plugins.trac.wordpress.org/browser/download-monitor/trunk/src/Admin/DownloadPaths/class-dlm-downloads-path.php
- https://plugins.trac.wordpress.org/browser/download-monitor/trunk/src/Admin/DownloadPaths/class-dlm-downloads-path.php
- https://plugins.trac.wordpress.org/changeset?old_path=/download-monitor/tags/5.1.10&new_path=/download-monitor/tags/5.1.11
- https://www.wordfence.com/threat-intel/vulnerabilities/id/33d70481-4652-44f4-99cf-67cc1ffab66a?source=cve