Download Monitor CVE-2026-39486

Exploitation requires a network-reachable WordPress site running Download Monitor at version 5.1.8 or earlier and a valid authenticated account at the low-privilege level indicated by CVSS PR:L (e.g., subscriber/contributor-class access, obtainable via open registration on many sites). No user interaction is needed (UI:N). The specific vulnerable input is the download-handling SQL query path within the plugin; the description confirms the flaw is a blind SQL injection, meaning data is inferred indirectly rather than returned. Limiting factors: the authentication requirement excludes fully anonymous attackers, exploitation is not automatable per CISA SSVC, and impact is confined to the WordPress database (confidentiality-focused, partial technical impact) rather than direct code execution.

The signals are mixed and lean toward a real-but-not-urgent priority. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L) yields 8.5 (High) driven by network reach, low complexity, and a changed scope, but it also requires PR:L - authenticated access - which meaningfully limits the attacker pool for a WordPress site. Real-world exploitation signals are low: EPSS is 0.02% (6th percentile), there is no KEV listing, no public exploit identified at time of analysis, and CISA SSVC rates Exploitation=none, Automatable=no, Technical Impact=partial. The SSVC 'partial' technical impact and the CVSS C:H/I:N/A:L profile agree that this is primarily a confidentiality/data-disclosure issue rather than full compromise. Note a tension worth verifying: the CVSS lists S:C (scope change) and A:L (availability impact), which is atypical for a read-oriented blind SQLi that usually maps to S:U with C:H/I:N/A:N - the elevated score may reflect Patchstack's conservative scoping rather than demonstrated cross-boundary or availability impact.

An attacker who holds or obtains a low-privilege authenticated WordPress account on a site running Download Monitor ≤5.1.8 submits crafted input to a vulnerable download-related parameter, injecting boolean or time-based SQL conditions. By observing differences in responses or timing, they iteratively extract sensitive database contents such as user records and password hashes. No public exploit is identified at time of analysis, and low attack complexity means a knowledgeable attacker could script the blind extraction once authenticated.