CVE-2026-4401
The Download Monitor plugin for WordPress is vulnerable to Cross-Site Request Forgery in the and methods in in all versions up to, and including, 5.1.10.
Published Apr 8, 2026 · updated Jul 24, 2026
The Download Monitor plugin for WordPress is vulnerable to Cross-Site Request Forgery in the and methods in in all versions up to, and including, 5.1.10. This is due to missing nonce verification on these functions. This makes it possible for unauthenticated attackers to delete, disable, or enable approved download paths via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Code
The project this record applies to. Exploit listings stay in References.
Timeline
Detection, updates, and resolution for this record.
Apr 8, 2026 · NIST NVD
Detected
The Download Monitor plugin for WordPress is vulnerable to Cross-Site Request Forgery in the and methods in in all versions up to, and including, 5.1.10. This is due to missing nonce verification on these functions. This makes it possible for unauthenticated attackers to delete, disable, or enable approved download paths via a forged request granted they can trick a site administrator into perform
Jul 24, 2026 · NIST NVD
Updated
The Download Monitor plugin for WordPress is vulnerable to Cross-Site Request Forgery in the and methods in in all versions up to, and including, 5.1.10. This is due to missing nonce verification on these functions. This makes it possible for unauthenticated attackers to delete, disable, or enable approved download paths via a forged request granted they can trick a site administrator into perform
Sources
- CVE.orgVulnerability recordCVE-2026-4401
Official CVE identifier
cve.org - NIST NVDVulnerability recordCVE-2026-4401
The Download Monitor plugin for WordPress is vulnerable to Cross-Site Request Forgery in the and methods in in all versions up to, and including, 5.1.10. This is due to missing nonce verification on these
nvd.nist.gov