What is the CVSS score of CVE-2026-39486?

CVE-2026-39486 has a CVSS 3.1 base score of 8.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L. EPSS exploitation probability: 0.0%.

Which versions of Download Monitor are affected by CVE-2026-39486?

The WP Chill Download Monitor plugin for WordPress contains a high-severity data exfiltration vulnerability affecting all versions through 5.1.8 that allows authenticated users to access sensitive…

How to fix or mitigate CVE-2026-39486?

Within 24 hours: Identify all WordPress installations running WP Chill Download Monitor, document versions in use, and disable the plugin if operationally feasible; if retention is necessary, restrict access to a minimal set of trusted administrators. Within 7 days: Configure database user permissions at the WordPress level to least-privilege (remove unnecessary table access), review audit logs for anomalous database queries, and subscribe to vendor and Patchstack advisories for patch notifications. Within 30 days: Verify patch availability for all affected versions and apply immediately upon release; if no patch timeline is provided by the vendor, evaluate and implement alternative download management solutions to eliminate this vulnerability from production.

Download Monitor CVE-2026-39486

EUVD-2026-20154 HIGH

SQL Injection (CWE-89)

2026-04-08 Patchstack

GHSA-hwvq-xm42-wx99

WordPress SQLi Download Monitor Wordpress Plugin Wp Chill

8.5

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

8.5 HIGH

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L

vuln.today AI

6.5 MEDIUM

Network-reachable low-complexity blind SQLi needs a low-privilege account (PR:L); it reads data (C:H) with no integrity or availability impact and no evidence of cross-scope effect, so S:U.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 08:12 vuln.today

CVSS changed

Apr 29, 2026 - 10:22 NVD

7.6 (HIGH) 8.5 (HIGH)

CVSS changed

Apr 21, 2026 - 21:22 NVD

7.6 (None) 7.6 (HIGH)

EUVD ID Assigned

Apr 08, 2026 - 08:45 euvd

EUVD-2026-20154

CVE Published

Apr 08, 2026 - 08:30 cve.org

HIGH 8.5

CVE Published

Apr 08, 2026 - 08:30 nvd

N/A

DescriptionCVE.org

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WP Chill Download Monitor download-monitor allows Blind SQL Injection.This issue affects Download Monitor: from n/a through <= 5.1.8.

AnalysisAI

Blind SQL injection in the WP Chill Download Monitor plugin for WordPress affects all versions from an unspecified early release through 5.1.8, letting an authenticated attacker inject crafted SQL into a database query and infer or exfiltrate backend data. The CVSS 3.1 base score is 8.5 (scope-changed) and Patchstack is the reporting source; there is no public exploit identified at time of analysis and the EPSS probability is very low at 0.02% (6th percentile). CISA SSVC scores exploitation as none, non-automatable, with partial technical impact, indicating a credible but not yet weaponized data-disclosure flaw.

Technical ContextAI

Download Monitor is a widely used WordPress plugin that manages downloadable files, tracks download counts, and enforces access rules, all backed by the WordPress MySQL/MariaDB database. The root cause is CWE-89 (Improper Neutralization of Special Elements in an SQL Command): user-controllable input reaches a SQL statement without proper parameterization or escaping, so an attacker can alter query logic. Because it is a blind variant, results are not returned directly in the response; the attacker infers data through boolean or time-based side channels. The single CPE, cpe:2.3:a:wp_chill:download_monitor:*:*:*:*:*:*:*:*, confirms the affected component is the Download Monitor plugin itself rather than WordPress core or another dependency.

RemediationAI

No vendor-released patch version is identified in the available data; the range is listed only as affected through 5.1.8 with no confirmed fixed release, so administrators should monitor the Patchstack advisory (https://patchstack.com/database/Wordpress/Plugin/download-monitor/vulnerability/wordpress-download-monitor-plugin-5-1-8-sql-injection-vulnerability) and the plugin's WordPress.org changelog for an update newer than 5.1.8 and apply it as soon as it ships. Until then, apply specific compensating controls: place a WAF or virtual patch (Patchstack/Wordfence rules) in front of the site to filter SQLi patterns on Download Monitor endpoints (trade-off: rule gaps may miss obfuscated blind payloads); tighten role assignments so untrusted users are not granted the low-privilege account level the exploit requires, and disable open user registration if it is not needed (trade-off: may affect legitimate contributor workflows); and restrict or monitor access to the plugin's download-management and AJAX endpoints, alerting on time-based or boolean SQLi indicators in query logs (trade-off: added monitoring overhead). If the plugin is non-essential, deactivating and removing it eliminates exposure entirely.