The Download Monitor plugin for WordPress contains a missing authorization (CWE-862) vulnerability in the ajax_handle_api_key_actions function. This flaw allows authenticated users with low-level privileges (Subscriber and above) to perform unauthorized actions on API keys, specifically revoking existing keys and generating new ones. The vulnerability affects all versions up to and including 5.0.12. The CVSS v3.1 base score is 4.3, reflecting a medium severity with low attack complexity and requiring only low privileges but no user interaction. No known exploits are reported in the wild, and no patch or vendor advisory confirming remediation is currently available.

An attacker with Subscriber-level access or higher can abuse this vulnerability to revoke and generate API keys within the Download Monitor plugin, potentially disrupting legitimate API usage or gaining unauthorized access through new API keys. The vulnerability does not impact confidentiality or availability directly but allows unauthorized modification of API keys, which could lead to further misuse depending on how those keys are used.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict user roles to trusted individuals only and monitor for suspicious activity related to API key management. Avoid granting Subscriber or higher privileges to untrusted users. Follow updates from wpchill for any forthcoming patches or official mitigations.