CVE-2026-4401 identifies a CSRF vulnerability in the Download Monitor plugin for WordPress, specifically in the actions_handler() and bulk_actions_handler() methods within class-dlm-downloads-path.php. The absence of nonce verification enables attackers to craft malicious requests that, when executed by an authenticated administrator, can modify approved download paths by deleting, disabling, or enabling them. This vulnerability affects all versions up to and including 5.1.10. The CVSS 3.1 base score is 5.4, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, no confidentiality impact, low integrity impact, and low availability impact.

An attacker can cause unauthorized changes to approved download paths by exploiting the CSRF vulnerability, potentially disrupting download availability or integrity. The impact is limited to integrity and availability with no confidentiality loss. Exploitation requires tricking an authenticated administrator into performing an action via a forged request. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should exercise caution with links and requests that could trigger actions in the Download Monitor plugin. Implementing additional CSRF protections or disabling the affected plugin functions may reduce risk.