Download Monitor, CVE-2026-16608

CVE, Research URL: CVE-2026-16608
Home page URL: Security reports for Download Monitor
Application: Download Monitor
Published on: Aug 08, 2026
Research Description: The Download Monitor WordPress plugin before 5.2.6 does not perform authorization checks on one of its download-logging AJAX actions, and exposes the nonce protecting it to unauthenticated visitors, allowing unauthenticated users to inject arbitrary download log entries and inflate a site's download statistics.
Affected versions: max 5.2.6.
Status: vulnerable