CVE-2026-4401
CSRF in WordPress Download Monitor Plugin Allows Admin Actions
Publication date: 2026-04-08
Last updated on: 2026-04-08
Assigner: Wordfence
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| download_monitor | download_monitor | to 5.1.10 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-352 | The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
The Download Monitor plugin for WordPress has a vulnerability known as Cross-Site Request Forgery (CSRF) in its `actions_handler()` and `bulk_actions_handler()` methods within the file `class-dlm-downloads-path.php`. This vulnerability exists in all versions up to and including 5.1.10.
The root cause is missing nonce verification in these functions, which means that the plugin does not properly verify that requests are legitimate and intended by the user.
As a result, an unauthenticated attacker can trick a site administrator into performing actions such as deleting, disabling, or enabling approved download paths by sending a forged request.
How can this vulnerability impact me? :
This vulnerability allows an attacker to perform unauthorized actions on your WordPress site if they can trick an administrator into clicking a malicious link.
- They can delete approved download paths, potentially removing important files or resources.
- They can disable or enable approved download paths, which might disrupt the availability or security of downloadable content.
Overall, this can lead to integrity and availability issues on your site, although it does not directly impact confidentiality.
What immediate steps should I take to mitigate this vulnerability?
The vulnerability exists due to missing nonce verification in the Download Monitor plugin for WordPress versions up to 5.1.10, allowing unauthenticated attackers to perform actions via forged requests.
Immediate mitigation steps include updating the Download Monitor plugin to a version later than 5.1.10 where the issue is fixed.
Additionally, as a temporary measure, restrict access to administrative functions and educate site administrators to avoid clicking on suspicious links.