Download Monitor, 938246df9c6e64214f96199eb617b2dfc97b1cae

CVE, Research URL: 938246df9c6e64214f96199eb617b2dfc97b1cae
Home page URL: Security reports for Download Monitor
Application: Download Monitor
Published on: Jun 09, 2023
Research Description: Download Monitor [download-monitor] < 4.7.70 Download Monitor <= 4.7.60 - Missing Authorization to Authenticated Data Export The Download Monitor plugin for WordPress is vulnerable to authorization bypass due to an insufficient capability check on several REST-API routes related to reporting in versions up to, and including, 4.7.60. This makes it possible for authenticated attackers, with minimal permissions such as a subscriber, to view user data and other sensitive information intended for administrators.
Affected versions: max 4.7.70.
Status: vulnerable