CVE-2026-39486

BRIEFING NOTE - CVE-2026-39486 A blind SQL injection vulnerability exists in the WP Chill Download Monitor plugin (versions through 5.1.8) that allows attackers to inject malicious SQL commands into database queries. This flaw in the download-monitor component enables unauthorized database access through improperly neutralized special elements in SQL commands. The vulnerability carries a CVSS score of 7.6 (HIGH) with a network-based attack vector requiring high user privileges but no user interaction. While the attack complexity is low, the impact includes high confidentiality compromise and low availability disruption, with potential cross-system consequences. The FAUCET Risk Score of 38.0/100 indicates moderate organizational risk. This vulnerability is not currently listed on the CISA Known Exploited Vulnerabilities (KEV) catalog and shows no evidence of active exploitation in the wild. The EPSS score of 0.00036 suggests minimal probability of exploitation, and community attention remains limited. Organizations running vulnerable versions should prioritize patching to versions after 5.1.8 as part of standard update cycles.