File Management Vulnerability in Download Monitor WordPress Plugin
CVE-2026-112219
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 23 October 2026
Badges
What is CVE-2026-112219?
The Download Monitor plugin for WordPress, prior to version 5.3.5, features an improper access control vulnerability that allows subsite administrators on multisite installations to manage a list of filesystem locations. This misconfiguration grants untrusted users the ability to approve arbitrary file locations, enabling them to serve files from outside the designated uploads directory. Consequently, this could lead to sensitive files belonging to various subsites being exposed to unauthenticated visitors, thereby posing a significant security risk.
Affected Version(s)
Download Monitor 0 < 5.3.5
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.