Description
The Download Monitor plugin for WordPress is vulnerable to Cross-Site Request Forgery in the `actions_handler()` and `bulk_actions_handler()` methods in `class-dlm-downloads-path.php` in all versions up to, and including, 5.1.10. This is due to missing nonce verification on these functions. This makes it possible for unauthenticated attackers to delete, disable, or enable approved download paths via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Published: 2026-04-07
Score: 5.4 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Unauthorized modification of download paths
Action: Patch Upgrade
AI Analysis

Impact

The Download Monitor plugin contains a cross‑site request forgery flaw in the actions_handler() and bulk_actions_handler() methods due to missing nonce verification. An attacker can forge a request that causes an authenticated administrator to delete, disable, or re‑enable approved download paths, effectively removing or exposing downloadable content.

Affected Systems

This vulnerability affects the WordPress plugin Download Monitor from vendor wpchill. All releases up to and including version 5.1.10 are impacted; later releases contain the fix.

Risk and Exploitability

The CVSS base score of 5.4 indicates moderate severity. Exploitation requires the attacker to entice an authenticated site administrator to click a crafted link or submit a form, so user interaction is necessary. No EPSS score is available and the entry is not listed in the CISA KEV catalog, suggesting that while exploitation is possible, it would require an active phishing or social engineering campaign targeting administrators.

Generated by OpenCVE AI on April 8, 2026 at 01:20 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade the Download Monitor plugin to version 5.1.11 or newer to remove the missing nonce verification.
  • If immediate upgrading is not possible, limit administrator access to the plugin’s bulk and delete path functions until the patch is applied.

Generated by OpenCVE AI on April 8, 2026 at 01:20 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 13 Apr 2026 16:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 08 Apr 2026 19:45:00 +0000

Type Values Removed Values Added
First Time appeared Wordpress
Wordpress wordpress
Wpchill
Wpchill download Monitor
Vendors & Products Wordpress
Wordpress wordpress
Wpchill
Wpchill download Monitor

Tue, 07 Apr 2026 23:30:00 +0000

Type Values Removed Values Added
Description The Download Monitor plugin for WordPress is vulnerable to Cross-Site Request Forgery in the `actions_handler()` and `bulk_actions_handler()` methods in `class-dlm-downloads-path.php` in all versions up to, and including, 5.1.10. This is due to missing nonce verification on these functions. This makes it possible for unauthenticated attackers to delete, disable, or enable approved download paths via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Title Download Monitor <= 5.1.10 - Cross-Site Request Forgery to Download Path Deletion and Disabling
Weaknesses CWE-352
References
Metrics cvssV3_1

{'score': 5.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L'}

Subscriptions

Wordpress Wordpress
Wpchill Download Monitor
cve-icon MITRE

Status: PUBLISHED

Assigner: Wordfence

Published:

Updated: 2026-04-13T15:15:10.823Z

Reserved: 2026-03-18T18:05:13.615Z

Link: CVE-2026-4401

cve-icon Vulnrichment

Updated: 2026-04-13T15:12:16.170Z

cve-icon NVD

Status : Deferred

Published: 2026-04-08T00:16:05.323

Modified: 2026-04-27T19:04:22.650

Link: CVE-2026-4401

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-08T19:45:08Z

Weaknesses