WordPress Plugin Vulnerabilities
Simple Download Monitor < 4.1.3 - Contributor+ Private Download Item Title and Description Disclosure via [sdm_show_download_info] Shortcode
Description
The plugin does not properly check the visibility of the content referenced by one of its shortcodes, allowing users with a role as low as Contributor to disclose the title and description of private, draft and other non-public posts.
Proof of Concept
Affects Plugins
Fixed in 4.1.3 References
CVE
Classification
Type
SENSITIVE DATA DISCLOSURE
OWASP top 10
CWE
CVSS
Miscellaneous
Original Researcher
Aaron
Submitter
Aaron
Submitter website
Submitter twitter
Verified
Yes
WPVDB ID
Timeline
Publicly Published
2026-11-02 (about 1 day ago)
Added
2026-11-02 (about 1 day ago)
Last Updated
2026-11-02 (about 1 day ago)
