CVE-2026-3124 is an insecure direct object reference vulnerability in the Download Monitor plugin for WordPress, affecting all versions up to and including 5.1.7. The vulnerability arises from missing validation on a user-controlled key in the executePayment() function, which handles order completion. This allows unauthenticated attackers to exploit a mismatch between PayPal transaction tokens and local orders, completing arbitrary pending orders without proper authorization. The impact is unauthorized completion of high-value orders by reusing payment tokens from low-cost transactions, leading to potential theft of digital goods. The CVSS 3.1 score is 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N), indicating high impact on integrity with no confidentiality or availability impact. There is no known exploit in the wild and no patch or remediation information currently available.

The vulnerability allows unauthenticated attackers to bypass authorization controls and complete arbitrary pending orders by exploiting a user-controlled key in the payment execution process. This can result in attackers finalizing high-value orders by reusing payment tokens from low-value transactions, leading to theft of paid digital goods. The integrity of the order processing system is compromised, but confidentiality and availability are not affected according to the CVSS vector. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling the Download Monitor plugin or restricting access to payment execution endpoints to trusted users only. Monitor vendor channels for updates and apply patches promptly once available.