CVE-2026-112219: CWE-863 Incorrect Authorization in Download Monitor
Description
The Download Monitor WordPress plugin before version 5.3.5 contains an authorization flaw that allows subsite administrators on multisite installations to manage filesystem locations served by the plugin. This flaw enables these subsite admins, who are not trusted at the network level, to approve arbitrary filesystem locations, potentially exposing readable files outside the uploads directory, including files from other subsites, to unauthenticated visitors. Single-site installations are not affected by this vulnerability.
Affected software
Download Monitor
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-112219 describes an incorrect authorization vulnerability (CWE-863) in the Download Monitor WordPress plugin versions prior to 5.3.5. On multisite WordPress setups, the plugin fails to restrict the management of filesystem locations it serves to network administrators only. Instead, subsite administrators can approve arbitrary filesystem locations, causing the plugin to serve files from outside the intended uploads directory. This can lead to unauthorized disclosure of files belonging to other subsites to unauthenticated users. Single-site installations are unaffected by this issue.
Potential Impact
Unauthorized subsite administrators on multisite WordPress installations can cause the plugin to serve files from arbitrary filesystem locations, potentially exposing sensitive files from other subsites to unauthenticated visitors. This can lead to information disclosure across subsites within the same multisite environment.
Mitigation Recommendations
Upgrade the Download Monitor WordPress plugin to version 5.3.5 or later, where this authorization issue is fixed. Until then, restrict subsite administrator privileges carefully on multisite installations to trusted users only. No official patch links were provided, but the version 5.3.5 release addresses this vulnerability.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- WPScan
- Date Reserved
- 2026-10-19T10:50:06.029Z
- State
- PUBLISHED
Threat ID: 6adafb9a4d27ba8daad7778d
Added to database: 10/23/2026, 06:15:54 UTC
Last enriched: 10/23/2026, 06:30:52 UTC
Last updated: 10/23/2026, 06:35:25 UTC
Views: 4
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.