What is the CVSS score of CVE-2026-3124?

CVE-2026-3124 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of WordPress are affected by CVE-2026-3124?

WP Download Monitor plugin versions 5.1.7 and earlier contain an authentication bypass vulnerability that allows unauthenticated attackers to manipulate PayPal payment tokens and complete arbitrary…

How to fix or mitigate CVE-2026-3124?

Within 24 hours: identify all WordPress instances running WP Download Monitor ≤5.1.7 using plugin inventory or vulnerability scanning tools. Within 7 days: disable the WP Download Monitor plugin, migrate to alternative digital goods fulfillment solutions (e.g., Easy Digital Downloads, SendOwl), or downgrade payment processing to manual verification only. Within 30 days: update to WP Download Monitor version >5.1.7 once patches are released, or implement permanent alternative solution with vendor confirmation of security remediation.

WordPress CVE-2026-3124

EUVD-2026-17052 HIGH

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-03-30 Wordfence

GHSA-r9gc-9vw9-725f

WordPress Authentication Bypass

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Re-analysis Queued

Apr 24, 2026 - 16:37 vuln.today

cvss_changed

EUVD ID Assigned

Mar 30, 2026 - 01:45 euvd

EUVD-2026-17052

Analysis Generated

Mar 30, 2026 - 01:45 vuln.today

CVE Published

Mar 30, 2026 - 01:24 nvd

HIGH 7.5

DescriptionCVE.org

The Download Monitor plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.1.7 via the executePayment() function due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to complete arbitrary pending orders by exploiting a mismatch between the PayPal transaction token and the local order, allowing theft of paid digital goods by paying a minimal amount for a low-cost item and using that payment token to finalize a high-value order.

AnalysisAI

Insecure Direct Object Reference in WP Download Monitor plugin (≤5.1.7) enables unauthenticated attackers to complete arbitrary pending orders by manipulating PayPal transaction tokens, allowing theft of paid digital goods. Attackers can pay minimal amounts for low-cost items and use those payment tokens to finalize high-value orders, effectively bypassing payment validation. CVSS 7.5 (High) reflects network-based attack with no authentication required. No public exploit identified at time of analysis, though the attack mechanism is clearly documented in vendor advisories.

Technical ContextAI

This vulnerability exists in the Download Monitor WordPress plugin (WP Chill, all versions through 5.1.7, CPE: cpe:2.3:a:wpchill:download_monitor). The flaw resides in the executePayment() function, which fails to properly validate the relationship between PayPal transaction tokens and local order identifiers. The root cause is classified as CWE-639 (Authorization Bypass Through User-Controlled Key), where the application trusts user-supplied tokens without verifying they correspond to the correct order. This creates a token substitution vulnerability where an attacker can initiate a legitimate low-value transaction, capture the PayPal success token, then replay that token against a different pending order in the system. The plugin's payment processing logic does not enforce binding between the external payment provider's transaction identifier and the specific cart/order contents, allowing cross-order token reuse.

RemediationAI

Upstream fix available via WordPress plugin repository changeset 3470119 (reference: https://plugins.trac.wordpress.org/changeset/3470119/download-monitor), though the released patched version number is not independently confirmed from available data. Site administrators should immediately update Download Monitor to the latest available version through the WordPress plugin update mechanism. Access the WordPress admin dashboard, navigate to Plugins, and apply available updates for Download Monitor. Until patching is complete, consider temporarily disabling PayPal payment processing in Download Monitor if high-value digital goods are at risk, or manually verify all completed orders against PayPal transaction records to detect fraudulent completions. Review recent order logs for anomalies such as low-value payments associated with high-value product deliveries. Consult the Wordfence advisory for additional mitigation guidance specific to your deployment configuration.