CVE-2026-4401

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-4401", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2026-03-18T18:05:13.615Z", "datePublished": "2026-04-07T23:25:27.305Z", "dateUpdated": "2026-04-13T15:15:10.823Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:45:36.054Z"}, "affected": [{"vendor": "wpchill", "product": "Download Monitor", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "5.1.10", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Download Monitor plugin for WordPress is vulnerable to Cross-Site Request Forgery in the `actions_handler()` and `bulk_actions_handler()` methods in `class-dlm-downloads-path.php` in all versions up to, and including, 5.1.10. This is due to missing nonce verification on these functions. This makes it possible for unauthenticated attackers to delete, disable, or enable approved download paths via a forged request granted they can trick a site administrator into performing an action such as clicking on a link."}], "title": "Download Monitor <= 5.1.10 - Cross-Site Request Forgery to Download Path Deletion and Disabling", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/33d70481-4652-44f4-99cf-67cc1ffab66a?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/download-monitor/trunk/src/Admin/DownloadPaths/class-dlm-downloads-path.php#L495"}, {"url": "https://plugins.trac.wordpress.org/browser/download-monitor/trunk/src/Admin/DownloadPaths/class-dlm-downloads-path.php#L427"}, {"url": "https://plugins.trac.wordpress.org/browser/download-monitor/tags/5.1.8/src/Admin/DownloadPaths/class-dlm-downloads-path.php#L427"}, {"url": "https://plugins.trac.wordpress.org/browser/download-monitor/tags/5.1.8/src/Admin/DownloadPaths/class-dlm-downloads-path.php#L495"}, {"url": "https://plugins.trac.wordpress.org/changeset?old_path=/download-monitor/tags/5.1.10&new_path=/download-monitor/tags/5.1.11#file11"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-352 Cross-Site Request Forgery (CSRF)", "cweId": "CWE-352", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L", "baseScore": 5.4, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Kirasec"}], "timeline": [{"time": "2026-03-18T18:20:28.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2026-04-07T11:17:36.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-4401", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-13T15:06:12.148640Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-13T15:15:10.823Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-4401", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-13T15:06:12.148640Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-13T15:12:16.170Z"}}], "cna": {"title": "Download Monitor <= 5.1.10 - Cross-Site Request Forgery to Download Path Deletion and Disabling", "credits": [{"lang": "en", "type": "finder", "value": "Kirasec"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 5.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L"}}], "affected": [{"vendor": "wpchill", "product": "Download Monitor", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "5.1.10"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2026-03-18T18:20:28.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2026-04-07T11:17:36.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/33d70481-4652-44f4-99cf-67cc1ffab66a?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/download-monitor/trunk/src/Admin/DownloadPaths/class-dlm-downloads-path.php#L495"}, {"url": "https://plugins.trac.wordpress.org/browser/download-monitor/trunk/src/Admin/DownloadPaths/class-dlm-downloads-path.php#L427"}, {"url": "https://plugins.trac.wordpress.org/browser/download-monitor/tags/5.1.8/src/Admin/DownloadPaths/class-dlm-downloads-path.php#L427"}, {"url": "https://plugins.trac.wordpress.org/browser/download-monitor/tags/5.1.8/src/Admin/DownloadPaths/class-dlm-downloads-path.php#L495"}, {"url": "https://plugins.trac.wordpress.org/changeset?old_path=/download-monitor/tags/5.1.10&new_path=/download-monitor/tags/5.1.11#file11"}], "descriptions": [{"lang": "en", "value": "The Download Monitor plugin for WordPress is vulnerable to Cross-Site Request Forgery in the `actions_handler()` and `bulk_actions_handler()` methods in `class-dlm-downloads-path.php` in all versions up to, and including, 5.1.10. This is due to missing nonce verification on these functions. This makes it possible for unauthenticated attackers to delete, disable, or enable approved download paths via a forged request granted they can trick a site administrator into performing an action such as clicking on a link."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-352", "description": "CWE-352 Cross-Site Request Forgery (CSRF)"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:45:36.054Z"}}}, "cveMetadata": {"cveId": "CVE-2026-4401", "state": "PUBLISHED", "dateUpdated": "2026-04-13T15:15:10.823Z", "dateReserved": "2026-03-18T18:05:13.615Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2026-04-07T23:25:27.305Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Download Monitor", "vendor": "wpchill", "versions": [{"lessThanOrEqual": "5.1.10", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Download Monitor plugin for WordPress is vulnerable to Cross-Site Request Forgery in the `actions_handler()` and `bulk_actions_handler()` methods in `class-dlm-downloads-path.php` in all versions up to, and including, 5.1.10. This is due to missing nonce verification on these functions. This makes it possible for unauthenticated attackers to delete, disable, or enable approved download paths via a forged request granted they can trick a site administrator into performing an action such as clicking on a link."}, {"lang": "es", "value": "El plugin Download Monitor para WordPress es vulnerable a falsificaci\u00f3n de petici\u00f3n en sitios cruzados en los m\u00e9todos 'actions_handler()' y 'bulk_actions_handler()' en 'class-dlm-downloads-path.php' en todas las versiones hasta la 5.1.10, inclusive. Esto se debe a la falta de verificaci\u00f3n de nonce en estas funciones. Esto hace posible que atacantes no autenticados eliminen, deshabiliten o habiliten rutas de descarga aprobadas a trav\u00e9s de una petici\u00f3n falsificada, siempre que puedan enga\u00f1ar a un administrador del sitio para que realice una acci\u00f3n como hacer clic en un enlace."}], "id": "CVE-2026-4401", "lastModified": "2026-07-24T23:10:00.563", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.5, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-4401", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-04-13T15:06:12.148640Z", "version": "2.0.3"}}]}, "published": "2026-04-08T00:16:05.323", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/download-monitor/tags/5.1.8/src/Admin/DownloadPaths/class-dlm-downloads-path.php#L427"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/download-monitor/tags/5.1.8/src/Admin/DownloadPaths/class-dlm-downloads-path.php#L495"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/download-monitor/trunk/src/Admin/DownloadPaths/class-dlm-downloads-path.php#L427"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/download-monitor/trunk/src/Admin/DownloadPaths/class-dlm-downloads-path.php#L495"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset?old_path=/download-monitor/tags/5.1.10&new_path=/download-monitor/tags/5.1.11#file11"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/33d70481-4652-44f4-99cf-67cc1ffab66a?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-352"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "unaffected", "versions": null}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "wordpress", "vendor": "wordpress"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,5.1.10]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Download Monitor", "source": "cna", "vendor": "wpchill"}, "product": "download_monitor", "vendor": "wpchill"}], "analysis": {"en": {"generated_at": "2026-04-08T01:20:40.205520+00:00", "value": {"mitigation_remediation": ["Upgrade the Download Monitor plugin to version 5.1.11 or newer to remove the missing nonce verification.", "If immediate upgrading is not possible, limit administrator access to the plugin\u2019s bulk and delete path functions until the patch is applied."], "summary": {"action": "Patch Upgrade", "impact": "Unauthorized modification of download paths"}, "threat_synthesis": {"affected_systems": "This vulnerability affects the WordPress plugin Download Monitor from vendor wpchill. All releases up to and including version 5.1.10 are impacted; later releases contain the fix.", "description_and_impact": "The Download Monitor plugin contains a cross\u2011site request forgery flaw in the actions_handler() and bulk_actions_handler() methods due to missing nonce verification. An attacker can forge a request that causes an authenticated administrator to delete, disable, or re\u2011enable approved download paths, effectively removing or exposing downloadable content.", "risk_and_exploitability": "The CVSS base score of 5.4 indicates moderate severity. Exploitation requires the attacker to entice an authenticated site administrator to click a crafted link or submit a form, so user interaction is necessary. No EPSS score is available and the entry is not listed in the CISA KEV catalog, suggesting that while exploitation is possible, it would require an active phishing or social engineering campaign targeting administrators."}}}}, "created": "2026-04-08T19:33:48.948544+00:00", "updated": "2026-04-08T19:45:08.180653+00:00", "vendors": ["wordpress", "wordpress$PRODUCT$wordpress", "wpchill", "wpchill$PRODUCT$download_monitor"]}