Medium severity5.3NVD Advisory· Published Aug 8, 2026· Updated Aug 26, 2026

CVE-2026-16608

Description

The Download Monitor WordPress plugin before 5.2.6 does not perform authorization checks on one of its download-logging AJAX actions, and exposes the nonce protecting it to unauthenticated visitors, allowing unauthenticated users to inject arbitrary download log entries and inflate a site's download statistics.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

WordPress/Download Monitorllm-fuzzy
Range: <5.2.6
Package: https://wordpress.org/plugins/download-monitor

Patches

Vulnerability mechanics

References

wpscan.com/vulnerability/f9573555-bd5c-451c-85dd-d964379d12d1/nvd

News mentions

Wordfence Intelligence Weekly WordPress Vulnerability Report (August 3, 2026 to August 9, 2026)
Wordfence Blog · Aug 14, 2026

cvss	0.345
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000