CVE-2026-16608: CWE-862 Missing Authorization in Download Monitor
The Download Monitor WordPress plugin before 5.2.6 does not perform authorization checks on one of its download-logging AJAX actions, and exposes the nonce protecting it to unauthenticated visitors, allowing unauthenticated users to inject arbitrary download log entries and inflate a site's download statistics.
AI Analysis
Technical Summary
CVE-2026-16608 is a missing authorization vulnerability (CWE-862) in the Download Monitor WordPress plugin versions prior to 5.2.6. The plugin fails to verify authorization on one of its AJAX actions responsible for logging downloads. Additionally, the nonce protecting this action is exposed to unauthenticated users, allowing them to inject arbitrary entries into the download logs and artificially inflate download counts.
Potential Impact
The vulnerability allows unauthenticated attackers to manipulate download statistics by injecting false log entries. This does not impact confidentiality or availability but affects the integrity of download data, potentially misleading site administrators or users relying on download metrics.
Mitigation Recommendations
No official fix or patch is currently confirmed. Users should upgrade to version 5.2.6 or later once available, as the vulnerability affects versions prior to 5.2.6. Until a patch is released, consider restricting access to the affected AJAX action or implementing custom authorization checks. Monitor the vendor advisory for updates on remediation.
CVE-2026-16608: CWE-862 Missing Authorization in Download Monitor
Description
The Download Monitor WordPress plugin before 5.2.6 does not perform authorization checks on one of its download-logging AJAX actions, and exposes the nonce protecting it to unauthenticated visitors, allowing unauthenticated users to inject arbitrary download log entries and inflate a site's download statistics.
CVSS v3.1
Score 5.3medium
Affected software
Download Monitor
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-16608 is a missing authorization vulnerability (CWE-862) in the Download Monitor WordPress plugin versions prior to 5.2.6. The plugin fails to verify authorization on one of its AJAX actions responsible for logging downloads. Additionally, the nonce protecting this action is exposed to unauthenticated users, allowing them to inject arbitrary entries into the download logs and artificially inflate download counts.
Potential Impact
The vulnerability allows unauthenticated attackers to manipulate download statistics by injecting false log entries. This does not impact confidentiality or availability but affects the integrity of download data, potentially misleading site administrators or users relying on download metrics.
Mitigation Recommendations
No official fix or patch is currently confirmed. Users should upgrade to version 5.2.6 or later once available, as the vulnerability affects versions prior to 5.2.6. Until a patch is released, consider restricting access to the affected AJAX action or implementing custom authorization checks. Monitor the vendor advisory for updates on remediation.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- WPScan
- Date Reserved
- 2026-07-22T14:31:56.823Z
- State
- PUBLISHED
Threat ID: 6a76cc2cbf8831d539114760
Added to database: 08/08/2026, 06:26:52 UTC
Last enriched: 08/15/2026, 15:00:01 UTC
Last updated: 09/22/2026, 01:52:42 UTC
Views: 76
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.