# Simple Download Monitor <= 4.1.3 - Unauthenticated Sensitive Information Exposure via Popular Downloads Shortcode

- **ID:** WPSEC-2026-2187
- **Plugin:** Simple Download Monitor (`simple-download-monitor`), https://wordpress.org/plugins/simple-download-monitor/
- **Affected versions:** all versions before 4.1.4
- **Fixed in:** 4.1.4 (Update to 4.1.4 or later.)
- **Severity:** Medium 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
- **Weakness:** CWE-200
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-11-03)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/simple-download-monitor
- **Fix released:** 2026-11-02
- **Published:** 2026-11-03
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2187/

## Description

The Simple Download Monitor plugin for WordPress is vulnerable to Sensitive Information Exposure via the [sdm_popular_downloads] shortcode in all versions up to, and including, 4.1.3. This is due to the popular downloads query not filtering download items by post status. This makes it possible for unauthenticated attackers to view the titles, descriptions, thumbnails and other details of private, draft, pending or trashed download items that have recorded downloads, on any page where the shortcode is displayed.

## References

- https://wpsec.com/vuln/WPSEC-2026-2187/
- https://plugins.svn.wordpress.org/simple-download-monitor/tags/4.1.4/
- https://wordpress.org/plugins/simple-download-monitor/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2187/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.