Download Monitor CVE-2026-16608

The Download Monitor WordPress plugin must be installed and active in a version earlier than 5.2.6. The vulnerable AJAX logging action is part of the plugin's default functionality - no optional feature or non-default configuration is required to expose it. Two specific conditions combine to enable unauthenticated exploitation: first, the AJAX action omits an authorization or capability check, permitting any visitor regardless of login state to invoke it; second, the nonce that WordPress would normally use to prevent CSRF is exposed in page HTML accessible without authentication, removing the one remaining protection layer. No server-side configuration, elevated privileges, or prior foothold is required. What limits the real-world impact is the narrow blast radius - only download log integrity is affected, with no path to data disclosure, privilege escalation, or remote code execution.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) reflects a network-reachable, zero-authentication attack with low complexity, but the bounded impact - limited solely to the integrity of download statistics - caps the score at 5.3 (Medium). The EPSS score of 0.14% (3rd percentile) is strikingly low given that a public exploit exists, suggesting that while exploitation is technically trivial, threat actors currently show minimal interest, likely because inflated download counts offer limited direct monetizable value. No CISA KEV listing corroborates active exploitation, and these two signals align to indicate opportunistic rather than systematic targeting. Even so, operators for whom download statistics drive commercial or reputational decisions - for instance, a mid-sized software distributor or municipal portal in sanok where fraudulent download counts could distort procurement metrics - should treat this as a low-urgency but straightforward patch. Using SSVC framing: exploitation status is 'public PoC', automatable is 'yes', technical impact is 'partial', pointing toward a 'scheduled' remediation posture rather than emergency response.

An attacker visits any publicly accessible page on the target WordPress site, retrieves the exposed nonce value from the rendered page HTML, then sends repeated crafted POST requests to wp-admin/admin-ajax.php targeting the logging action with arbitrary file identifiers and download counts. Because no authentication is required and attack complexity is low, this process is fully scriptable. A publicly available exploit referenced via WPScan automates injection at scale, enabling an attacker to skew download statistics for any tracked file on the site.