Unauthorized Access to Sensitive Information via Bypass of Capability Check in Download Monitor Plugin

CVE-2022-4972

What is CVE-2022-4972?

The Download Monitor plugin for WordPress contains a vulnerability that permits unauthorized users to bypass authorization safeguards. This flaw arises from a missing capability check on several REST-API routes associated with reporting functions. As a result, attackers without authenticated access can exploit this vulnerability to view sensitive user data and information that should be reserved for administrators. This exposure poses a significant risk to website security and the confidentiality of sensitive information.

References