CVE-2026-4401

The Download Monitor WordPress plugin versions up to and including 5.1.10 contains a Cross-Site Request Forgery vulnerability in its download path management functions. The flaw stems from missing nonce verification in the actions_handler() and bulk_actions_handler() methods within class-dlm-downloads-path.php, enabling unauthenticated attackers to manipulate approved download paths if they can deceive site administrators into clicking a malicious link. The vulnerability carries a CVSS 3.1 score of 5.4 (Medium) and is network-accessible with low attack complexity, requiring only user interaction from an administrator. The attack does not require privileges to initiate but results in integrity and availability impacts, allowing deletion, disabling, or enabling of download paths without authorization. There is currently no evidence of active exploitation in the wild, as indicated by the absence from the Known Exploited Vulnerabilities catalog and its inactive status on industry hot lists. The extremely low EPSS score of 0.00022 suggests minimal real-world exploitation activity and community attention at this time, though organizations running vulnerable versions should prioritize patching to prevent potential abuse.