Insecure Direct Object Reference in Download Monitor Plugin for WordPress

CVE-2026-3124

What is CVE-2026-3124?

The Download Monitor plugin for WordPress contains an Insecure Direct Object Reference vulnerability that can be exploited by unauthenticated attackers. This issue arises from insufficient validation in the executePayment() function, allowing attackers to utilize a user-controlled key to complete arbitrary pending orders. By manipulating the mismatch between the PayPal transaction token and the corresponding local order, attackers can potentially steal digital goods, bypassing legitimate payment requirements by paying a nominal fee for low-cost items while finalizing access to high-value orders.

References