anonhaven

CVE-2026-16608

NONE EPSS 0.14%
Updated Aug 08, 2026
Unknown
Parameter Value
Affected Versions before 5.2.6
Type CWE-862 Missing Authorization
Vendor Unknown
Public PoC No

The Download Monitor WordPress plugin before 5.2.6 does not perform authorization checks on one of its download-logging AJAX actions, and exposes the nonce protecting it to unauthenticated visitors, allowing unauthenticated users to inject arbitrary download log entries and inflate a site's download statistics.

Weakness Type (CWE)

CWE-862 Missing Authorization

Vulnerable Products

unknown:download monitor

References 1

https://wpscan.com/vulnerability/f9573555-bd5c-451c-85dd-d964379d12d1/
NVD
Share Post Share Share Share

Related Vulnerabilities

CVE-2026-16955

Unknown

None

CVE-2026-16953

Unknown

None

CVE-2026-16948

Unknown

None

CVE-2026-16595

Unknown

None

CVE-2026-16594

Unknown

None