Medium severity4.3NVD Advisory· Published Sep 26, 2024· Updated Jun 17, 2026

CVE-2024-8552

Description

The Download Monitor plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the enable_shop() function in all versions up to, and including, 5.0.9. This makes it possible for authenticated attackers, with Subscriber-level access and above, to enable shop functionality.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Wpchill/Download Monitor2 versions
cpe:2.3:a:wpchill:download_monitor:*:*:*:*:*:wordpress:*:*+ 1 more
- cpe:2.3:a:wpchill:download_monitor:*:*:*:*:*:wordpress:*:*range: <5.0.10
- (no CPE)range: 0
WordPress/Download Monitorllm-fuzzy
Range: <=5.0.9
Package: https://wordpress.org/plugins/download-monitor

Patches

Vulnerability mechanics

References

plugins.trac.wordpress.org/changeset/3157424/nvdPatch
www.wordfence.com/threat-intel/vulnerabilities/id/3acaedff-f616-4b66-9208-f7e6a4df920dnvdThird Party Advisory
plugins.trac.wordpress.org/browser/download-monitor/tags/5.0.8/src/AjaxHandler.phpnvdProduct

News mentions

No linked articles in our index yet.

cvss	0.280
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000