The Download Monitor plugin for WordPress suffers from a missing capability check in its ajax_search_users function, allowing authenticated users with Subscriber-level privileges or higher to access usernames and email addresses of other users on the site. This vulnerability is classified as CWE-862 (Missing Authorization) and affects all versions up to and including 5.0.13. The CVSS 3.1 base score is 4.3, reflecting a low complexity attack vector requiring authentication and resulting in limited confidentiality impact without affecting integrity or availability.

An attacker with at least Subscriber-level access can obtain usernames and email addresses of site users, potentially leading to privacy violations or facilitating further targeted attacks such as phishing. There is no impact on data integrity or system availability. The vulnerability requires authentication, limiting exposure to users who already have some level of access.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict Subscriber-level access to trusted users only and monitor for suspicious activity related to user data access. Avoid granting unnecessary privileges to low-level authenticated users.