What is the CVSS score of CVE-2026-16608?

CVE-2026-16608 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.1%.

Is there a public PoC exploit available for CVE-2026-16608?

Yes, a public proof-of-concept exploit is available for CVE-2026-16608. Prioritise patching immediately. EPSS: 0.1%.

Is there a patch available for CVE-2026-16608?

Yes, a patch is available for CVE-2026-16608. Update the affected software to the latest version immediately.

Download Monitor CVE-2026-16608

EUVD-2026-54742 MEDIUM

Missing Authorization (CWE-862)

2026-08-08 WPScan

GHSA-25m3-39mc-92qp

WordPress Authentication Bypass Download Monitor Unknown

5.3

CVSS 3.1 · Vendor: WPScan

Severity by source

Vendor (WPScan) PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

vuln.today AI

5.3 MEDIUM

Network-accessible AJAX endpoint requires no authentication or user interaction; impact is confined to low integrity via log injection with no confidentiality or availability consequence.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (WPScan).

CVSS VectorVendor: WPScan

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 11, 2026 - 23:20 vuln.today

CVSS changed

Aug 11, 2026 - 20:22 NVD

5.3 (MEDIUM)

Patch available

Aug 08, 2026 - 07:01 EUVD

CVE Published

Aug 08, 2026 - 06:00 cve.org

UNKNOWN (no severity yet)

CVE Published

Aug 08, 2026 - 06:00 cve.org

MEDIUM 5.3

DescriptionCVE.org

The Download Monitor WordPress plugin before 5.2.6 does not perform authorization checks on one of its download-logging AJAX actions, and exposes the nonce protecting it to unauthenticated visitors, allowing unauthenticated users to inject arbitrary download log entries and inflate a site's download statistics.

AnalysisAI

Download Monitor WordPress plugin versions before 5.2.6 fails to enforce authorization on an AJAX download-logging endpoint and simultaneously leaks the nonce that would normally gatekeep it to unauthenticated visitors, enabling arbitrary log injection. Any unauthenticated remote attacker can inject fabricated entries into the plugin's download log to artificially inflate a site's download statistics. Publicly available exploit code exists per WPScan reporting; however, with no CISA KEV listing and an EPSS of 0.14% (3rd percentile), real-world exploitation appears limited to opportunistic or targeted campaigns rather than widespread active abuse.

Technical ContextAI

The Download Monitor plugin (CPE: cpe:2.3:a:unknown:download_monitor:*:*:*:*:*:*:*:*) provides file download management and analytics for WordPress sites. It registers AJAX hooks to record download events, and one such hook omits a sufficient capability or nonce validation to restrict access - a textbook CWE-862 (Missing Authorization) defect. Compounding the issue, the nonce associated with this action is rendered in page HTML visible to unauthenticated visitors, eliminating the CSRF-token layer that would otherwise require foreknowledge of a valid value. WordPress AJAX endpoints are universally reachable at wp-admin/admin-ajax.php on any standard installation, meaning the attack surface is exposed on any site running the affected plugin regardless of theme or other configuration.

RemediationAI

The primary fix is to upgrade the Download Monitor WordPress plugin to version 5.2.6 or later, which introduces proper authorization checks on the affected AJAX logging endpoint and restricts nonce exposure to authenticated contexts only. Site administrators should apply this update immediately through the WordPress plugin dashboard or via the WP-CLI command 'wp plugin update download-monitor'. Details are available at https://wpscan.com/vulnerability/f9573555-bd5c-451c-85dd-d964379d12d1/ and https://nvd.nist.gov/vuln/detail/CVE-2026-16608. If immediate patching is not feasible, a compensating control is to configure a WAF rule blocking unauthenticated POST requests to wp-admin/admin-ajax.php that carry the specific vulnerable action parameter - however, identifying that parameter requires inspection of plugin source code, and an overly broad rule risks disrupting legitimate plugin functionality for authenticated users. Deactivating the plugin entirely is a viable short-term measure if download tracking is non-essential.