# Download Monitor <= 5.3.4 - Authenticated (Administrator+) Incorrect Authorization to Approved Download Paths Modification via REST API

- **ID:** WPSEC-2026-1348
- **Plugin:** Download Monitor (`download-monitor`), https://wordpress.org/plugins/download-monitor/
- **Affected versions:** from 5.3.0 before 5.3.5
- **Fixed in:** 5.3.5 (Update to 5.3.5 or later.)
- **Severity:** Medium 5.8 (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:N)
- **Weakness:** CWE-863
- **Usage among sites WPSec scans:** plugin High, affected versions Medium (as of 2026-10-21)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/download-monitor
- **Fix released:** 2026-10-20
- **Published:** 2026-10-21
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1348/

## Description

The Download Monitor plugin for WordPress is vulnerable to incorrect authorization via the download-paths REST API endpoints in versions 5.3.0 up to, and including, 5.3.4, due to the endpoints that list, add, edit and delete approved download paths checking only the manage_options capability instead of the plugin's own access check, which requires the manage_network capability on multisite. On multisite installations, this makes it possible for authenticated attackers with site-level Administrator access who are not network Super Admins to add arbitrary server directories to their site's approved download paths. They could then serve, and so read, files outside their own site, such as other sites' uploads or system files.

## References

- https://wpsec.com/vuln/WPSEC-2026-1348/
- https://plugins.svn.wordpress.org/download-monitor/tags/5.3.5/
- https://wordpress.org/plugins/download-monitor/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1348/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.