Download Monitor CVE-2026-39489

Exploitation requires an authenticated WordPress session with at minimum Author-level role privileges - anonymous or unauthenticated requests cannot trigger the vulnerability. The Download Monitor plugin must be installed and active on the WordPress site. The CVSS vector specifies AC:H, meaning there is likely a specific request format, parameter structure, or plugin configuration state required for successful path traversal beyond basic authentication. The vulnerability is network-exploitable (AV:N), meaning the WordPress site must be reachable over the network. Limiting factors include: the attacker must possess or compromise valid Author (or higher) credentials; the target site must be running plugin version <= 5.1.9; and successful traversal depends on web server filesystem permissions governing which files the PHP process can read.

The vendor-assigned CVSS 3.1 score is 4.4 (Medium) with vector AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N, reflecting high attack complexity and high privileges required, which materially constrains real-world risk. The PR:H designation warrants scrutiny: in WordPress taxonomy, the 'Author' role is a non-administrative authenticated role with limited site-wide control, which many practitioners would classify as PR:L rather than PR:H - if PR:L is correct, the effective score would be closer to 5.3. No EPSS data was provided, preventing quantitative exploitation probability assessment. KEV status is not confirmed, and no public POC has been identified. Practically, this vulnerability is limited to environments where untrusted users hold WordPress Author accounts, a non-default trust boundary in many deployments. The impact is confidentiality-only (C:H, I:N, A:N), but that high confidentiality impact is significant given that arbitrary file read on a WordPress server can expose database credentials via wp-config.php. The AC:H metric suggests the exploit is not trivially repeatable and may require specific plugin configuration or request conditions.

An attacker who has obtained or registered a WordPress Author account on a target site sends a crafted download request to the Download Monitor plugin, embedding path traversal sequences (e.g., '../../wp-config.php') in the file parameter. Because the plugin does not properly sanitize the path, the server returns the contents of the targeted file, exposing database credentials or other sensitive configuration data. No public exploit code has been identified at time of analysis, though the path traversal technique is well-understood by attackers.