Unrated severityNVD Advisory· Published Sep 26, 2024· Updated Apr 8, 2026

Download Monitor <= 5.0.9 - Missing Authorization to Authenticated (Subscriber+) Shop Enable

CVE-2024-8552

Description

The Download Monitor plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the enable_shop() function in all versions up to, and including, 5.0.9. This makes it possible for authenticated attackers, with Subscriber-level access and above, to enable shop functionality.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

WordPress/Download Monitorllm-fuzzy
Range: <=5.0.9
Package: https://wordpress.org/plugins/download-monitor
Wpchill/Download Monitorcpe-rescue
Range: 0

Patches

Vulnerability mechanics

References

plugins.trac.wordpress.org/browser/download-monitor/tags/5.0.8/src/AjaxHandler.phpmitre
plugins.trac.wordpress.org/changeset/3157424/mitre
www.wordfence.com/threat-intel/vulnerabilities/id/3acaedff-f616-4b66-9208-f7e6a4df920dmitre

News mentions

No linked articles in our index yet.

cvss	0.000
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000