An injection flaw exists in the Simple Download Monitor plugin where data supplied to the database is not properly sanitized, enabling attackers to execute arbitrary SQL statements in a blind manner. A successful exploitation could allow the attacker to read, modify or delete information stored in the WordPress database, compromising the confidentiality and integrity of site content and potentially affecting user accounts or financial records.

WordPress sites running the mra13 Simple Download Monitor plugin and any version up to 3.9.25 are vulnerable. The issue applies to every release from the earliest available version through 3.9.25, requiring the plugin to be upgraded or replaced to avoid exposure.

The CVSS score of 7.6 reflects significant impact and the potential for data exposure. With an EPSS score of less than 1%, real‑world exploitation is considered unlikely at present, and the vulnerability is not listed in CISA’s KEV catalog. However, blind injection can be carried out by sending crafted requests to the plugin’s input points—such as search or download handler forms—without needing to view returned data. Attackers can infer database contents or structure by observing time delays or error responses, thereby bypassing more restrictive defenses.