CVE-2026-16608 Download Monitor < 5.2.6 - Unauthenticated Download Log Injection

The Download Monitor WordPress plugin before 5.2.6 does not perform authorization checks on one of its download-logging AJAX actions, and exposes the nonce protecting it to unauthenticated visitors, allowing unauthenticated users to inject arbitrary download log entries and inflate a site's...

PT-2026-69181

Name of the Vulnerable Software and Affected Versions Download Monitor versions prior to 5.2.6 Description An issue exists where the plugin fails to perform authorization checks on a download-logging AJAX action. Additionally, the nonce a unique token used to prevent cross-site request forgery...