CVE-2026-112219: Download Monitor < 5.3.5 - Multisite Subsite Admin+ Incorrect Authorization via Approved Download Paths REST Route

Q: Which installations are affected?

Only WordPress multisite installations using Download Monitor before 5.3.5 are affected. Single-site WordPress installations are unaffected.

Q: What access does an attacker need?

The attacker needs administrator privileges on a subsite, but does not need to be trusted as a network administrator. They can approve arbitrary filesystem locations through the affected REST route.

Q: What could an attacker expose?

They may cause the plugin to serve readable files located outside the uploads directory to unauthenticated visitors. This can include files belonging to other subsites.

Q: How can I tell whether this condition applies to my environment?

Confirm that WordPress is configured as multisite, that Download Monitor is installed at a version earlier than 5.3.5, and that subsite administrators exist who are not trusted network administrators.

Published Oct 23, 2026

Updated

The Download Monitor WordPress plugin before 5.3.5 does not correctly restrict management of the list of filesystem locations it may serve files from to network administrators on multisite, allowing a subsite administrator who is not trusted at the network level to approve arbitrary locations and have the Download Monitor WordPress plugin before 5.3.5 serve readable files from outside the uploads directory, including files belonging to other subsites, to unauthenticated visitors; single-site installations are unaffected.

Affected Software

1 affected component

WPChill Download Monitor<5.3.5

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Download Monitor WordPress plugin to a version that resolves this vulnerability.
Fixed in 5.3.5

Event History

Oct 23, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Frequently Asked Questions

Which installations are affected?

Only WordPress multisite installations using Download Monitor before 5.3.5 are affected. Single-site WordPress installations are unaffected.

What access does an attacker need?

The attacker needs administrator privileges on a subsite, but does not need to be trusted as a network administrator. They can approve arbitrary filesystem locations through the affected REST route.

What could an attacker expose?

They may cause the plugin to serve readable files located outside the uploads directory to unauthenticated visitors. This can include files belonging to other subsites.

How can I tell whether this condition applies to my environment?

Confirm that WordPress is configured as multisite, that Download Monitor is installed at a version earlier than 5.3.5, and that subsite administrators exist who are not trusted network administrators.

CVE-2026-112219: Download Monitor < 5.3.5 - Multisite Subsite Admin+ Incorrect Authorization via Approved Download Paths REST Route

Affected Software

Remediation

Event History

Frequently Asked Questions

Which installations are affected?

What access does an attacker need?

What could an attacker expose?

How can I tell whether this condition applies to my environment?

Company

Resources

Contact

Frequently Asked Questions

Which installations are affected?

What access does an attacker need?

What could an attacker expose?

How can I tell whether this condition applies to my environment?