CVE-2026-4401 is a CSRF vulnerability in the Download Monitor plugin for WordPress affecting all versions up to 5.1.10. The issue arises from missing nonce verification in the actions_handler() and bulk_actions_handler() methods within class-dlm-downloads-path.php. This allows attackers to perform state-changing operations on approved download paths by tricking site administrators into clicking malicious links. The vulnerability does not require prior authentication but does require user interaction from an administrator. The CVSS 3.1 base score is 5.4, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, no confidentiality impact, low integrity impact, and low availability impact.

An attacker can cause an administrator to unknowingly delete, disable, or enable approved download paths on a vulnerable WordPress site. This could disrupt the availability or integrity of download paths managed by the plugin. There is no direct confidentiality impact. The vulnerability requires user interaction by an administrator and does not allow remote code execution or privilege escalation by itself. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, administrators should avoid clicking on untrusted links while logged into WordPress with administrative privileges. Monitoring for plugin updates from wpchill is recommended to apply any forthcoming patches addressing this CSRF vulnerability.