Description
The Download Monitor plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.1.7 via the executePayment() function due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to complete arbitrary pending orders by exploiting a mismatch between the PayPal transaction token and the local order, allowing theft of paid digital goods by paying a minimal amount for a low-cost item and using that payment token to finalize a high-value order.
Published: 2026-03-30
Score: 7.5 High
EPSS: < 1% Very Low
KEV: No
Impact: Unauthorized Order Completion
Action: Patch Immediately
AI Analysis

Impact

The Download Monitor plugin for WordPress contains an insecure direct object reference flaw in the executePayment() function, allowing unauthenticated users to submit a PayPal transaction token that does not match the local order ID. By crafting a request with a forged token and order_id, an attacker can complete any pending order with minimal payment, effectively stealing paid digital goods. This vulnerability is classified as CWE‑639 and can result in financial loss for site owners.

Affected Systems

The flaw affects the Download Monitor plugin from wpchill. All versions up to and including 5.1.7 are vulnerable, so any WordPress site running one of these plugin versions is at risk.

Risk and Exploitability

The CVSS base score of 7.5 indicates a high severity; the exploit does not require authentication or elevated privileges, making it straightforward for attackers to complete arbitrary orders. EPSS data is not available and the vulnerability is not listed in the CISA KEV catalog, but its potential for remote payment fraud makes it an attractive target for malicious actors.

Generated by OpenCVE AI on March 30, 2026 at 05:21 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Download Monitor to a version newer than 5.1.7
  • Restrict access to the executePayment endpoint so only authenticated users can invoke it
  • Consult the plugin vendor’s website or the WordPress repository for any additional patches or advisories

Generated by OpenCVE AI on March 30, 2026 at 05:21 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 30 Mar 2026 15:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 30 Mar 2026 07:15:00 +0000

Type Values Removed Values Added
First Time appeared Wordpress
Wordpress wordpress
Wpchill
Wpchill download Monitor
Vendors & Products Wordpress
Wordpress wordpress
Wpchill
Wpchill download Monitor

Mon, 30 Mar 2026 03:30:00 +0000

Type Values Removed Values Added
Description The Download Monitor plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.1.7 via the executePayment() function due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to complete arbitrary pending orders by exploiting a mismatch between the PayPal transaction token and the local order, allowing theft of paid digital goods by paying a minimal amount for a low-cost item and using that payment token to finalize a high-value order.
Title Download Monitor <= 5.1.7 - Insecure Direct Object Reference to Unauthenticated Arbitrary Order Completion via 'token' and 'order_id'
Weaknesses CWE-639
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N'}

Subscriptions

Wordpress Wordpress
Wpchill Download Monitor
cve-icon MITRE

Status: PUBLISHED

Assigner: Wordfence

Published:

Updated: 2026-03-30T14:56:17.380Z

Reserved: 2026-02-24T14:05:44.981Z

Link: CVE-2026-3124

cve-icon Vulnrichment

Updated: 2026-03-30T14:56:06.657Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-03-30T02:16:15.630

Modified: 2026-03-30T13:26:07.647

Link: CVE-2026-3124

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-03-30T07:03:44Z

Weaknesses