Download Monitor <= 5.3.4 - Authenticated (Administrator+) Incorrect Authorization to Approved Download Paths Modification via REST API
- ID
- WPSEC-2026-1348
- Plugin
- Download Monitor (download-monitor)
- Affected
- from 5.3.0 before 5.3.5
- Remediation
- Update to 5.3.5 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:N
- Weakness
- CWE-863
- Usage
- Plugin High · Affected versions Medium among sites WPSec scans, 2026-10-21
- Attack surface
- Download Monitor on WPSec AttackSurface
- Fix released
- Published
Description
The Download Monitor plugin for WordPress is vulnerable to incorrect authorization via the download-paths REST API endpoints in versions 5.3.0 up to, and including, 5.3.4, due to the endpoints that list, add, edit and delete approved download paths checking only the manage_options capability instead of the plugin's own access check, which requires the manage_network capability on multisite. On multisite installations, this makes it possible for authenticated attackers with site-level Administrator access who are not network Super Admins to add arbitrary server directories to their site's approved download paths. They could then serve, and so read, files outside their own site, such as other sites' uploads or system files.
References
- https://wpsec.com/vuln/WPSEC-2026-1348/
- https://plugins.svn.wordpress.org/download-monitor/tags/5.3.5/
- https://wordpress.org/plugins/download-monitor/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS