CVE-2026-16608CWE-862broken-access-control

CVE-2026-16608

Medium · published August 8, 2026

CVSS v3.1

5.3

EPSS

Percentile

21.9

In the wild

Unconfirmed

What it is

The Download Monitor WordPress plugin before 5.2.6 does not perform authorization checks on one of its download-logging AJAX actions, and exposes the nonce protecting it to unauthenticated visitors, allowing unauthenticated users to inject arbitrary download log entries and inflate a site's download statistics.

The record

Technical detail

CVSS v3.1: 5.3 · MEDIUM
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CVSS v4.0: Not supplied
EPSS: 0.00304 · 21.9th percentile
Weakness: CWE-862 · Missing Authorization
Published: 2026-08-08T11:17Z

References (1)

https://wpscan.com/vulnerability/f9573555-bd5c-451c-85dd-d964379d12d1/ · [email protected]

EPSS history

Timeline

08 AUG 06:00Z
Download Monitor < 5.2.6 - Unauthenticated Download Log Injection
cvelistv5