5.4
Moyenne
CVE-2026-4401 The Download Monitor plugin for WordPress is vulnerable to Cross-Site Request Forgery in the `actions_handler()` and…
Description
The Download Monitor plugin for WordPress is vulnerable to Cross-Site Request Forgery in the `actions_handler()` and `bulk_actions_handler()` methods in `class-dlm-downloads-path.php` in all versions up to, and including, 5.1.10. This is due to missing nonce verification on these functions. This makes it possible for unauthenticated attackers to delete, disable, or enable approved download paths via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Download Monitor 5.1 | premières → 5.1.10 | Pas de correctif indiqué |
Autres CVE de Download Monitor
Les 13 CVE de Download Monitor →
CVE-2026-100182
The Download Monitor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Cross-Origin postMessage to…
7.2
Élevée
CVE-2026-3124
The Download Monitor plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and…
7.5
Élevée
CVE-2024-10399
The Download Monitor plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability…
4.3
Moyenne
CVE-2024-10092
The Download Monitor plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability…
4.3
Moyenne