Extension WordPress
Vulnérabilités Download Monitor
Cette page rassemble les failles publiées pour Download Monitor, leurs plages de versions affectées et les correctifs signalés dans la base locale.
Historique de sécurité
CVE et vulnérabilités de Download Monitor
29 fiches
Download Monitor <= 5.1.9 – Authenticated (Author+) Arbitrary File Download
The Download Monitor plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 5.1.9. This makes it possible for authenticated attackers, with Author-level access and above, to read the contents of arbitrary files…
*-5.1.9
5.1.10
20/04/2026
Download Monitor <= 5.1.10 – Cross-Site Request Forgery to Download Path Deletion and Disabling
The Download Monitor plugin for WordPress is vulnerable to Cross-Site Request Forgery in the `actions_handler()` and `bulk_actions_handler()` methods in `class-dlm-downloads-path.php` in all versions up to, and including, 5.1.10. This is due to missing nonce verification on these functions.…
*-5.1.10
5.1.11
07/04/2026
Download Monitor <= 5.1.7 – Insecure Direct Object Reference to Unauthenticated Arbitrary Order Completion via 'token' and 'order_id'
The Download Monitor plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.1.7 via the executePayment() function due to missing validation on a user controlled key. This makes it possible…
*-5.1.7
5.1.8
29/03/2026
Download Monitor <= 5.1.8 – Authenticated (Contributor+) SQL Injection
The Download Monitor plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 5.1.8 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This…
*-5.1.8
5.1.9
25/03/2026
Download Monitor <= 5.0.22 – Authenticated (Contributor+) Local File Inclusion
The Download Monitor plugin for WordPress is vulnerable to Local File Inclusion via the get_template_part() function in versions up to, and including, 5.0.22. This makes it possible for authenticated attackers, with contributor-level access and above, to include and…
*-5.0.22
5.0.23
07/05/2025
Download Monitor <= 5.0.13 – Missing Authorization to Sensitive Information Exposure
The Download Monitor plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ajax_search_users function in all versions up to, and including, 5.0.13. This makes it possible for authenticated attackers,…
*-5.0.13
5.0.14
29/10/2024
Download Monitor <= 5.0.12 – Missing Authorization to API Key Manipulation
The Download Monitor plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ajax_handle_api_key_actions function in all versions up to, and including, 5.0.12. This makes it possible for authenticated attackers,…
*-5.0.12
5.0.13
25/10/2024
Download Monitor <= 5.0.9 – Missing Authorization to Authenticated (Subscriber+) Shop Enable
The Download Monitor plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the enable_shop() function in all versions up to, and including, 5.0.9. This makes it possible for authenticated attackers,…
*-5.0.9
5.0.10
25/09/2024
Download Monitor <= 4.9.13 – Missing Authorization
The Download Monitor plugin for WordPress is vulnerable to unauthorized access to functionality due to a missing capability check on the dlm_uninstall_plugin function in all versions up to, and including, 4.9.13. This makes it possible for authenticated attackers…
*-4.9.13
4.9.14
29/05/2024
Download Monitor <= 4.9.4 – Authenticated (Admin+) SQL Injection
The Download Monitor plugin for WordPress is vulnerable to SQL Injection via the 'limit' parameter in all versions up to 4.9.5 (exclusive) due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the…
[*, 4.9.5)
4.9.5
08/01/2024
Download Monitor <= 4.8.3 – Authenticated(Subscriber+) Arbitrary File Upload via upload_file
The Download Monitor plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation and access controls on the 'upload_file' function in versions up to, and including, 4.8.3. This makes it possible for authenticated…
[*, 4.8.4)
4.8.4
07/06/2023
Download Monitor <= 4.8.1 – Authenticated (Admin+) Server-Side Request Forgery
The Download Monitor plugin for WordPress is vulnerable to Server-Side Request Forgery in versions up to, and including, 4.8.1 via the trigger() function. This makes it possible for authenticated attackers with administrative privileges to make web requests to…
*-4.8.1
4.8.2
30/05/2023
Download Monitor <= 4.7.60 – Sensitive Information Exposure via REST API
The Download Monitor plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 4.7.60 via REST API. This can allow unauthenticated attackers to extract sensitive data including user reports, download reports, and user…
*-4.7.60
4.7.70
10/05/2023
Download Monitor <= 4.7.51 – Missing Authorization to Unauthenticated Data Export
The Download Monitor plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on several REST-API routes related to reporting in versions up to, and including, 4.7.51. This makes it possible for unauthenticated attackers…
*-4.7.51
4.7.52
26/11/2022
Download Monitor <= 4.7.2 – Authenticated Directory Traversal to Sensitive Information Exposure
The Download Monitor plugin for WordPress is vulnerable to Directory Traversal in versions up to, and including, 4.7.2 via the list_files function. This allows users with manage_downloads permissions to read the contents of arbitrary files on the server,…
*-4.7.2
4.7.3
01/11/2022
Download Monitor <= 4.5.97 – Authenticated (Administrator+) Arbitrary File Download
The Download Monitor plugin for WordPress is vulnerable to arbitrary file downloads due to not verifying that downloaded files reside within the blog directory in versions up to, and including, 4.5.97. This makes it possible for authenticated attackers,…
*-4.5.97
4.5.98
19/09/2022
Download Monitor <= 4.5.9 – Authenticated Arbitrary File Download
The Download Monitor WordPress plugin before 4.5.91 does not ensure that files to be downloaded are inside the blog folders, and not sensitive, allowing high privilege users such as admin to download the wp-config.php or /etc/passwd even in…
*-4.5.9
4.5.91
27/06/2022
Download Monitor <= 4.4.6 – Authenticated (Admin+) Stored Cross-Site Scripting
Authenticated (admin+) Persistent Cross-Site Scripting (XSS) vulnerability discovered in Download Monitor WordPress plugin (versions
*-4.4.6
4.4.7
29/10/2021
Download Monitor <= 4.4.6 – Authenticated (Admin+) Arbitrary File Download
Authenticated (admin+) Arbitrary File Download vulnerability discovered in Download Monitor WordPress plugin (versions
*-4.4.6
4.4.7
29/10/2021
Download Monitor <= 4.4.6 – Reflected Cross-Site Scripting
Authenticated Reflected Cross-Site Scripting (XSS) vulnerability discovered in WordPress plugin Download Monitor (versions
*-4.4.6
4.4.7
29/10/2021
Extensions également surveillés
WP Commander
Rechercher dans toute la base WordPress
Utilisez la recherche globale pour retrouver une extension, un thème, une CVE ou un identifiant de vulnérabilité.