7.5
High
CVE-2022-4972 The Download Monitor plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on…
Description
The Download Monitor plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on several REST-API routes related to reporting in versions up to, and including, 4.7.51. This makes it possible for unauthenticated attackers to view user data and other sensitive information intended for administrators.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Download Monitor 4.7 | earliest → 4.7.51 | No fix stated |
| download_monitor 4.7 | earliest → 4.7.51 | No fix stated |
Other CVEs of Download Monitor
The 13 CVEs of Download Monitor →
CVE-2026-100182
The Download Monitor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Cross-Origin postMessage to…
7.2
High
CVE-2026-4401
The Download Monitor plugin for WordPress is vulnerable to Cross-Site Request Forgery in the `actions_handler()` and…
5.4
Medium
CVE-2026-3124
The Download Monitor plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and…
7.5
High
CVE-2024-10399
The Download Monitor plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability…
4.3
Medium