CVE-2026-109896: WordPress Download Monitor integration for WooCommerce plugin <= 1.0.3 - Broken Access Control vulnerability
Missing Authorization vulnerability in WP Chill Download Monitor integration for WooCommerce download-monitor-integration-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Download Monitor integration for WooCommerce: from n/a through 1.0.3.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
wordpress/download-monitor-integration-for-woocommerceto a version that resolves this vulnerability.Fixed in 1.0.4
Event History
Frequently Asked Questions
What level of access does an attacker need?
The attacker needs low-level privileges. Exploitation is network-accessible, requires low attack complexity, and does not require user interaction.
What is the expected impact if exploitation succeeds?
The reported impact is limited to confidentiality. The CVSS vector indicates low confidentiality impact, with no integrity or availability impact.
Which installations are in scope?
The issue affects WP Chill Download Monitor integration for WooCommerce versions through 1.0.3. The available data does not identify a fixed version or any configuration conditions that would exclude an installation from exposure.