Download Monitor EUVD-2026-108596

Requires a WordPress multisite deployment of Download Monitor before 5.3.5; single-site installations are explicitly unaffected. The attacker must already be an authenticated subsite administrator (CVSS PR:H) who is not a network administrator - the flaw is that management of the served-file-location allowlist is not correctly restricted to network admins, so a subsite admin can approve arbitrary readable locations outside the uploads directory. The realized confidentiality impact (files served to unauthenticated visitors) is downstream of that admin action. Limiting factors: no exploitation without multisite mode and without a subsite-admin-level account, which narrows real exposure to multi-tenant/agency/hosted networks with untrusted subsite operators.

This is a genuine but moderate-priority issue, not a top-tier emergency. The CVSS 3.1 base score is 4.9 (medium) with vector AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N: network-reachable and low-complexity, but gated behind PR:H - the attacker must already hold a subsite administrator account on a WordPress multisite network. The SSVC signals align with a measured response: Exploitation=none (no observed activity), Automatable=no, Technical Impact=partial, and the vuln.today decision label is 'this_month' rather than act_now or emergency. It is NOT listed in CISA KEV, so there is no public exploit identified at time of analysis (the WPScan and NVD links are advisory references, not verified working exploit code). No EPSS score was provided in the input, so exploitation probability cannot be quantified here - treat that as missing data rather than 'low risk confirmed.' The real limiting factor is the trust model: exploitation requires an untrusted-but-still-administrative subsite operator abusing authorization reserved for network admins, which is realistic in large hosted/agency multisite environments but irrelevant to single-site installs. One signal worth verifying: the input tags this as 'Authentication Bypass,' but CWE-863 and the description describe a broken-authorization / privilege boundary failure (a legitimately authenticated subsite admin exceeding intended scope), not an authentication bypass - see data_quality_flags.

On a WordPress multisite network, a subsite administrator who is not trusted at the network level uses Download Monitor's location-management feature to approve a filesystem path outside the uploads directory - for example a directory holding another subsite's private files or server configuration. Download Monitor then serves those readable files through download links to any unauthenticated visitor. No public exploit code is identified at time of analysis; the attack requires only a subsite-admin account plus a multisite deployment.