Unrated severityNVD Advisory· Published Aug 8, 2026

CVE-2026-16608

Description

The Download Monitor WordPress plugin before 5.2.6 does not perform authorization checks on one of its download-logging AJAX actions, and exposes the nonce protecting it to unauthenticated visitors, allowing unauthenticated users to inject arbitrary download log entries and inflate a site's download statistics.

Affected products

WordPress/Download Monitorllm-fuzzy
Range: <5.2.6
Package: https://wordpress.org/plugins/download-monitor

Patches

Vulnerability mechanics

References

wpscan.com/vulnerability/f9573555-bd5c-451c-85dd-d964379d12d1/nvd

News mentions

No linked articles in our index yet.

cvss	0.000
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000