Unrated severityNVD Advisory· Published Oct 16, 2024· Updated Apr 8, 2026

Download Monitor <= 4.7.51 - Missing Authorization to Unauthenticated Data Export

CVE-2022-4972

Description

The Download Monitor plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on several REST-API routes related to reporting in versions up to, and including, 4.7.51. This makes it possible for unauthenticated attackers to view user data and other sensitive information intended for administrators.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Simple Download Monitor/Simple Download Monitorllm-fuzzy
Range: <=4.7.51
Wpchill/Download Monitorcpe-rescue
Range: 0
WordPress/Simple Download Monitorwp-canonicalize
Package: https://wordpress.org/plugins/simple-download-monitor

Patches

Vulnerability mechanics

References

plugins.trac.wordpress.org/changeset/2822758/download-monitor/trunk/src/Admin/Reports/class-dlm-reports.phpmitre
www.wordfence.com/threat-intel/vulnerabilities/id/a9000c52-fdd7-43e2-ae6a-9f127c4a9fcdmitre

News mentions

No linked articles in our index yet.

cvss	0.000
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000