CVE-2026-16608 — Download Monitor < 5.2.6 - Unauthenticated Download Log Injection
The Download Monitor WordPress plugin before 5.2.6 does not perform authorization checks on one of its download-logging AJAX actions, and exposes the nonce protecting it to unau…
Published: 2026-08-08 · CVSS: 5.3 · CVSS 3.1
The Download Monitor WordPress plugin before 5.2.6 does not perform authorization checks on one of its download-logging AJAX actions, and exposes the nonce protecting it to unauthenticated visitors, allowing unauthenticated users to inject arbitrary download log entries and inflate a site's download statistics.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7