The vulnerability exists in older releases of the Download Monitor WordPress plugin where a specific AJAX action that records download events lacks an authorization check and exposes its protection nonce to any visitor. An attacker can therefore forge arbitrary log entries, causing a site to report inflated download counts. This manipulation corrupts analytics and distorts website metrics but does not provide code execution or other direct system compromise capabilities.

WordPress sites running the Download Monitor plugin before version 5.2.6 are affected. The vulnerability applies to any installation of the plugin whose version is lower than 5.2.6; exact sub‑versions are not listed beyond this threshold.

The attack vector is unauthenticated, meaning any user with access to the site can exploit the flaw simply by targeting the AJAX endpoint. Because the flaw relies only on the exposure of the nonce and the missing permission check, it is trivial to craft malicious requests. The CVSS score of 5.3 indicates a medium severity. The EPSS score is below 1%, indicating a very low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog, suggesting it has not been widely exploited in the wild yet. Nevertheless, a site administrator could readily increase download statistics, leading to inaccurate reporting and potential reputational harm. The risk level is moderate: the exploitation is easy, but the impact is limited to data integrity rather than direct security compromise.