medium5.3
CVE-2026-16608
The Download Monitor WordPress plugin before 5.2.6 does not perform authorization checks on one of its download-logging AJAX actions, and exposes the nonce pro…
Impact
The Download Monitor WordPress plugin before 5.2.6 does not perform authorization checks on one of its download-logging AJAX actions, and exposes the nonce protecting it to unauthenticated visitors, allowing unauthenticated users to inject arbitrary download log entries and inflate a site's download statistics.
Affected products
| Product | Affected versions |
|---|---|
| Download Monitor WordPress Plugin | before 5.2.6 |
Versions were read from the advisory text. No structured product data has been published for this record yet.