CVE-2022-4972: Download Monitor <= 4.7.51 - Missing Authorization to Unauthenticated Data Export
The Download Monitor plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on several REST-API routes related to reporting in versions up to, and including, 4.7.51. This makes it possible for unauthenticated attackers to view user data and other sensitive information intended for administrators.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2022-4972?
CVE-2022-4972 is assigned a moderate severity level due to the potential for unauthorized access to user data.
How do I fix CVE-2022-4972?
To fix CVE-2022-4972, update the Download Monitor plugin to version 4.7.52 or later.
Who is affected by CVE-2022-4972?
Any user running version 4.7.51 or earlier of the Download Monitor plugin for WordPress is affected by CVE-2022-4972.
What vulnerabilities come with CVE-2022-4972?
CVE-2022-4972 allows unauthenticated attackers to bypass authorization and access sensitive user data.
Is there a workaround for CVE-2022-4972?
A temporary workaround for CVE-2022-4972 is to disable the Download Monitor plugin until an update is applied.