Download Monitor EUVD-2026-17052

Download Monitor plugin for WordPress versions up to 5.1.7 with e-commerce functionality enabled. Requires attacker to obtain a valid PayPal transaction token from a low-cost item purchase, then exploit executePayment() function to finalize arbitrary high-value orders. No authentication or user interaction required; unauthenticated remote exploitation.

Real-world risk is HIGH for sites using Download Monitor with paid digital goods. The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates network-accessible exploitation with low complexity and no authentication required, making this trivially exploitable. While EPSS data is not provided, the combination of unauthenticated remote access and direct financial impact suggests elevated exploitation likelihood. This is not confirmed actively exploited (no CISA KEV listing), but the technical barrier is minimal-attackers need only purchase a low-cost item and intercept the payment token to steal high-value digital products. The integrity impact is High (I:H) as attackers can bypass payment validation entirely. For e-commerce sites selling premium downloads, courses, or software licenses through this plugin, this represents immediate financial loss potential. The attack is automatable once the token manipulation technique is understood, and requires no user interaction. Sites not using Download Monitor's payment features face no risk from this specific vulnerability.

An attacker browses a WordPress site selling premium digital downloads (e.g., software licenses at $299 and ebooks at $5 via Download Monitor). The attacker adds the $5 ebook to their cart, proceeds to PayPal checkout, and completes the legitimate payment. Upon successful payment, PayPal redirects back with a transaction token (e.g., token=EC-ABC123XYZ). The attacker captures this token from the URL. Next, the attacker initiates a separate order for the $299 software license but abandons payment, leaving it in pending status. The attacker then crafts a request to the executePayment() function, substituting the captured low-value token into the high-value pending order request. Due to missing validation, the plugin marks the expensive order as paid and delivers the premium software, while the attacker has only spent $5. The site owner loses $294 in revenue per fraudulent transaction.