Vulnerabilities / Simple Download Monitor / WPSEC-2026-2187
Simple Download Monitor <= 4.1.3 - Unauthenticated Sensitive Information Exposure via Popular Downloads Shortcode
Medium 5.3
CWE-200Fixed in 4.1.4
- ID
- WPSEC-2026-2187
- Plugin
- Simple Download Monitor (simple-download-monitor)
- Affected
- all versions before 4.1.4
- Remediation
- Update to 4.1.4 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- Weakness
- CWE-200
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-11-03
- Attack surface
- Simple Download Monitor on WPSec AttackSurface
- Fix released
- Published
Description
The Simple Download Monitor plugin for WordPress is vulnerable to Sensitive Information Exposure via the [sdm_popular_downloads] shortcode in all versions up to, and including, 4.1.3. This is due to the popular downloads query not filtering download items by post status. This makes it possible for unauthenticated attackers to view the titles, descriptions, thumbnails and other details of private, draft, pending or trashed download items that have recorded downloads, on any page where the shortcode is displayed.
References
- https://wpsec.com/vuln/WPSEC-2026-2187/
- https://plugins.svn.wordpress.org/simple-download-monitor/tags/4.1.4/
- https://wordpress.org/plugins/simple-download-monitor/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS