{
 "id": "WPSEC-2026-2187",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2187/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2187/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2187/index.md",
 "title": "Simple Download Monitor <= 4.1.3 - Unauthenticated Sensitive Information Exposure via Popular Downloads Shortcode",
 "description": "The Simple Download Monitor plugin for WordPress is vulnerable to Sensitive Information Exposure via the [sdm_popular_downloads] shortcode in all versions up to, and including, 4.1.3. This is due to the popular downloads query not filtering download items by post status. This makes it possible for unauthenticated attackers to view the titles, descriptions, thumbnails and other details of private, draft, pending or trashed download items that have recorded downloads, on any page where the shortcode is displayed.",
 "plugin": {
  "slug": "simple-download-monitor",
  "name": "Simple Download Monitor",
  "full_name": "Simple Download Monitor",
  "wordpress_org": "https://wordpress.org/plugins/simple-download-monitor/",
  "advisories_url": "https://wpsec.com/vuln/plugin/simple-download-monitor/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/simple-download-monitor"
 },
 "type": "SENSITIVE DATA DISCLOSURE",
 "cwe": [
  "CWE-200"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "4.1.4",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 4.1.4"
  ]
 },
 "introduced_in": null,
 "fixed_in": "4.1.4",
 "remediation": "Update to 4.1.4 or later.",
 "fix_released": "2026-11-02T06:22:38+00:00",
 "published": "2026-11-03T14:48:33+00:00",
 "updated": "2026-11-03T13:19:28.891885+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2187/",
  "https://plugins.svn.wordpress.org/simple-download-monitor/tags/4.1.4/",
  "https://wordpress.org/plugins/simple-download-monitor/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/simple-download-monitor",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Medium",
  "affected_versions": "Medium",
  "as_of": "2026-11-03"
 }
}