The vulnerability arises because the Download Monitor WordPress plugin, in versions earlier than 5.3.5, fails to enforce proper authorization when managing approved file system locations on multisite installations. A subsite administrator that is not a network administrator can add arbitrary directories to the list of approved download paths via the REST API. This allows the plugin to serve files located outside the intended uploads directory, including files belonging to other subsites, to anyone who can access the site, regardless of authentication status. The result is unauthorized read access to potentially sensitive files and a privilege escalation within the WordPress multisite network.

All sites that run the Download Monitor WordPress plugin with a version older than 5.3.5 on a multisite WordPress network are affected. Single site WordPress installations of the plugin are not vulnerable. Sites that upgrade to version 5.3.5 or later are considered fixed.

EPSS data is not available and the issue is not listed in CISA KEV, but the severity of allowing unauthenticated file disclosure suggests a high risk. The exploitation requires only that the attacker have subsite administrator privileges; the attack is carried out through the REST API endpoint, which is accessible over HTTP and does not need additional authentication beyond the administrative session. Once configured, the attacker can serve arbitrary files from the server to any visitor, exposing internal data and potentially enabling further exploitation.