PT-2026-31050 · WordPress · Download Monitor

Kirasec · Published 2026-04-07 · Updated 2026-04-08 · CVE-2026-4401

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L

Name of the Vulnerable Software and Affected Versions The Download Monitor plugin for WordPress versions up to and including 5.1.10

Description The Download Monitor plugin for WordPress is susceptible to Cross-Site Request Forgery (CSRF) due to missing nonce verification in the actions handler() and bulk actions handler() methods within the class-dlm-downloads-path.php file. This allows unauthenticated attackers to potentially delete, disable, or enable approved download paths by tricking a site administrator into performing an action, such as clicking a malicious link.

Recommendations Update to a version of The Download Monitor plugin for WordPress greater than 5.1.10.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2026-4401

Affected Products

Download Monitor

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2026-4401 · Security Note
• https://plugins.trac.wordpress.org/browser/download-monitor/trunk/src/Admin/DownloadPaths/class-dlm-downloads-path.php#L495 · Note
• https://plugins.trac.wordpress.org/browser/download-monitor/trunk/src/Admin/DownloadPaths/class-dlm-downloads-path.php#L427 · Note
• https://plugins.trac.wordpress.org/changeset?old_path=/download-monitor/tags/5.1.10&new_path=/download-monitor/tags/5.1.11#file11 · Note
• https://twitter.com/CVEnew/status/2041711840808595493 · Twitter Post
• https://plugins.trac.wordpress.org/browser/download-monitor/tags/5.1.8/src/Admin/DownloadPaths/class-dlm-downloads-path.php#L427 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/33d70481-4652-44f4-99cf-67cc1ffab66a?source=cve · Note
• https://plugins.trac.wordpress.org/browser/download-monitor/tags/5.1.8/src/Admin/DownloadPaths/class-dlm-downloads-path.php#L495 · Note
• https://twitter.com/CVEarity/status/2041758700428574721 · Twitter Post