EUVD-2026-98913
GHSA-6qw5-p5p9-96v2
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as low-privilege user
-
ExploitCall plugin action lacking authorization check
-
ExecutionAccess restricted download/order data
-
ImpactLimited information disclosure
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires an authenticated account with at least low privileges on a WordPress/WooCommerce site running the Download Monitor integration for WooCommerce plugin version 1.0.3 or earlier (PR:L). The flaw stems from incorrectly configured access-control levels on a plugin feature, so exploitation depends on the vulnerable plugin being installed and active alongside WooCommerce; no user interaction is needed (UI:N). Limiting factors: a valid logged-in account is mandatory, impact is confined to limited confidentiality (C:L, no integrity or availability effect), and sites not running this specific integration plugin are unaffected. |
| Impact | This is a moderate, authenticated access-control flaw (CWE-862, Missing Authorization) rather than a top-tier emergency. The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, base 4.3) indicates a network-reachable, low-complexity issue requiring some level of authenticated privilege (PR:L), with only limited confidentiality impact and no integrity or availability impact - consistent with a low-privileged user (e.g., subscriber/customer) reaching data or an action they should not. No EPSS score, KEV listing, or POC reference is present in the supplied data, so there is no public exploit identified at time of analysis and no evidence of active exploitation; the only source is a single Patchstack advisory. The signals are internally consistent (low severity, partial confidentiality-only impact, authentication required), so this reads as a genuinely lower-priority issue rather than an over-scored critical. EPSS is simply absent (not low-despite-KEV), so no conflicting-signal situation exists - the main gap is the lack of an independent vendor advisory confirming exploited behavior and fixed version. |
| Exploit ScenarioDerived | A user with a low-privileged authenticated account on a WooCommerce store running this plugin (through v1.0.3) sends a request to a plugin endpoint that fails to verify authorization, obtaining limited information they should not have access to. No public exploit code is referenced, and successful abuse requires a valid low-privilege account, limiting the realistic attacker population. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 13, 2026
An authenticated attacker with low privileges can bypass access controls in the WordPress plugin Download Monitor integration for WooCommerce versions up to 1.0.3, leading to unauthorized access to limited confidential information. This moderate-severity missing authorization flaw (CWE-862) requires a valid logged-in account and does not allow data modification or service disruption; no public exploit code has been identified at the time of analysis. The plugin must be installed alongside WooCommerce, and only sites running this specific integration are affected.
RemediationAI
No vendor-released patch identified at time of analysis; administrators should check the Patchstack advisory for updates and apply any patched version as soon as it becomes available. In the interim, if the plugin is not essential, deactivate and uninstall it to eliminate exposure. If it must remain active, restrict access by auditing user accounts and removing or downgrading unnecessary low-privileged users; ensure that only trusted roles have any capabilities related to Download Monitor or WooCommerce downloads. Additionally, monitor logs for unauthorized access to download monitor endpoints. Because the vulnerability requires authentication, reducing the number of authenticated users and applying least privilege significantly lowers risk. The advisory URL is https://patchstack.com/database/wordpress/plugin/download-monitor-integration-for-woocommerce/vulnerability/wordpress-download-monitor-integration-for-woocommerce-plugin-1-0-3-broken-access-control-vulnerability?_s_id=cve.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is a classic Missing Authorization (CWE-862) issue in a WordPress plugin that integrates Download Monitor with WooCommerce. The plugin fails to verify that the current user has the necessary capabilities before performing certain actions or returning protected data, likely omitting capability checks such as current_user_can(). As a result, any authenticated user with a low-privileged role (e.g., subscriber or customer) can access functionality or information that should be restricted to higher-privileged users. The affected component is identified by CPE cpe:2.3:a:wp_chill:download_monitor_integration_for_woocommerce:*:*:*:*:*:*:*:* and impacts all versions through 1.0.3. The root cause is incorrectly configured access control levels, which is common in WordPress plugins where developers assume that authentication alone is sufficient authorization.
Know when Download Monitor Integration For Woocommerce gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Missing authorization reachable over the network by a logged-in low-privilege user, so AV:N/AC:L/PR:L/UI:N; limited data exposure only yields C:L with I:N/A:N.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Missing Authorization vulnerability in WP Chill Download Monitor integration for WooCommerce download-monitor-integration-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Download Monitor integration for WooCommerce: from n/a through 1.0.3.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB