What is the CVSS score of CVE-2026-39489?

CVE-2026-39489 has a CVSS 3.1 base score of 4.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.3%.

Download Monitor CVE-2026-39489

EUVD-2026-36941 MEDIUM

Path Traversal (CWE-22)

2026-06-15 Patchstack

GHSA-hr7w-wxf5-p6cc

Path Traversal Download Monitor

4.4

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

4.4 MEDIUM

AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

5.3 MEDIUM

WordPress Author role provides basic authenticated access (PR:L), not administrative control; AC:H retained as traversal likely requires specific request conditions.

3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 15, 2026 - 23:14 vuln.today

DescriptionCVE.org

Author Arbitrary File Download in Download Monitor <= 5.1.9 versions.

AnalysisAI

Path traversal in the WordPress Download Monitor plugin (versions <= 5.1.9, by WP Chill) allows a network-accessible attacker with Author-level WordPress credentials to download arbitrary files from the server, achieving high confidentiality impact. The vulnerability (CWE-22) stems from improper sanitization of file paths within the plugin's download functionality, enabling directory traversal outside the intended file scope. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, and no EPSS data was provided to quantify exploitation probability.

Technical ContextAI

The Download Monitor plugin (CPE: cpe:2.3:a:wp_chill:download_monitor:*:*:*:*:*:*:*:*) is a WordPress file-management and delivery plugin. The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory - Path Traversal): the plugin fails to canonicalize or adequately restrict the file path supplied to the download handler, allowing a crafted request to traverse above the intended download directory (e.g., using '../' sequences) and retrieve arbitrary files accessible to the web server process. Because WordPress runs as a system user with read access to configuration files, this class of bug can expose wp-config.php, server credentials, or other sensitive data. The vulnerability was discovered and reported by Patchstack, which specializes in WordPress ecosystem security.

RemediationAI

Update the Download Monitor plugin to a version above 5.1.9, as patch availability per vendor advisory is indicated by the Patchstack database entry at https://patchstack.com/database/wordpress/plugin/download-monitor/vulnerability/wordpress-download-monitor-plugin-5-1-9-non-arbitrary-file-download-vulnerability. No exact fixed version number was independently confirmed from the provided data - verify the current release in the WordPress plugin repository before upgrading. As a compensating control while patching is pending, restrict Author-role access to the WordPress installation to only trusted individuals, since the exploit requires Author-level authentication. Additionally, consider restricting web server filesystem permissions so the PHP process cannot read sensitive files outside the webroot (e.g., ensuring wp-config.php is readable only by the web server user, not traversable via plugin mechanisms). Note that restricting Author accounts may impact publishing workflows for legitimate users.