# Simple Download Monitor <= 4.1.2 - Authenticated (Contributor+) Sensitive Information Exposure via 'sdm_show_download_info' Shortcode

- **ID:** WPSEC-2026-1802
- **Plugin:** Simple Download Monitor (`simple-download-monitor`), https://wordpress.org/plugins/simple-download-monitor/
- **Affected versions:** all versions before 4.1.3
- **Fixed in:** 4.1.3 (Update to 4.1.3 or later.)
- **Severity:** Medium 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)
- **Weakness:** CWE-200
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-10-28)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/simple-download-monitor
- **Fix released:** 2026-10-27
- **Published:** 2026-10-28
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1802/

## Description

The Simple Download Monitor plugin for WordPress is vulnerable to Sensitive Information Exposure via the 'sdm_show_download_info' shortcode in all versions up to, and including, 4.1.2. This is due to the shortcode not checking whether a download item is published or viewable by the current user, and returning the raw file URL even for items that are password protected, limited to logged-in users, or that require reCAPTCHA or Terms and Conditions. This makes it possible for authenticated attackers, with contributor-level access and above, to obtain the title, description and direct file URL of private, draft or protected download items and download the files without passing the plugin's download access checks.

## References

- https://wpsec.com/vuln/WPSEC-2026-1802/
- https://plugins.svn.wordpress.org/simple-download-monitor/tags/4.1.3/
- https://wordpress.org/plugins/simple-download-monitor/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1802/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.