What is the CVSS score of CVE-2026-4401?

CVE-2026-4401 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L. EPSS exploitation probability: 0.0%.

PHP CVE-2026-4401

EUVD-2026-19992 MEDIUM

Cross-Site Request Forgery (CSRF) (CWE-352)

2026-04-08 security@wordfence.com

GHSA-jhmj-fqr7-r4cv

WordPress PHP CSRF

5.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

Low

Lifecycle Timeline

EUVD ID Assigned

Apr 08, 2026 - 00:22 euvd

EUVD-2026-19992

Analysis Generated

Apr 08, 2026 - 00:22 vuln.today

CVE Published

Apr 08, 2026 - 00:16 nvd

MEDIUM 5.4

DescriptionCVE.org

The Download Monitor plugin for WordPress is vulnerable to Cross-Site Request Forgery in the actions_handler() and bulk_actions_handler() methods in class-dlm-downloads-path.php in all versions up to, and including, 5.1.10. This is due to missing nonce verification on these functions. This makes it possible for unauthenticated attackers to delete, disable, or enable approved download paths via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

AnalysisAI

Cross-Site Request Forgery in Download Monitor plugin for WordPress up to version 5.1.10 allows unauthenticated attackers to delete, disable, or enable approved download paths by tricking site administrators into clicking a malicious link, due to missing nonce verification in the actions_handler() and bulk_actions_handler() methods. The vulnerability requires user interaction (UI:R) and has a moderate CVSS score of 5.4, with impacts limited to integrity and availability of download path configurations rather than confidentiality.

Technical ContextAI

The Download Monitor WordPress plugin contains a critical CSRF vulnerability rooted in CWE-352 (Cross-Site Request Forgery). The vulnerability exists in the class-dlm-downloads-path.php file within the actions_handler() and bulk_actions_handler() methods, which process administrative requests to manage download paths without validating WordPress nonce tokens. Nonces are WordPress's primary defense mechanism against CSRF attacks-they are time-limited, user-specific tokens that must be present and valid for state-changing operations. The absence of nonce verification means that any state-changing HTTP request to these handlers will be processed if initiated by an authenticated administrator, regardless of the request's origin. An attacker can craft HTML or JavaScript that, when loaded by a logged-in administrator, silently triggers administrative actions on their behalf.

RemediationAI

Site administrators must upgrade Download Monitor to version 5.1.11 or later immediately. This patched version restores nonce verification to the actions_handler() and bulk_actions_handler() methods, restoring CSRF protection. For sites unable to update immediately, temporary mitigation includes restricting administrative access to trusted IP ranges and limiting administrator user accounts to essential personnel. Workaround is not feasible without code modification, as nonce validation must be implemented in the plugin itself. Verification of the patch can be confirmed by reviewing the changeset at https://plugins.trac.wordpress.org/changeset?old_path=/download-monitor/tags/5.1.10&new_path=/download-monitor/tags/5.1.11, and further threat intelligence is available from Wordfence at https://www.wordfence.com/threat-intel/vulnerabilities/id/33d70481-4652-44f4-99cf-67cc1ffab66a.