CVE-2026-118637: Simple Download Monitor < 4.1.3 - Contributor+ Private Download Item Title and Description Disclosure via [sdm_show_download_info] Shortcode
The Simple Download Monitor WordPress plugin before 4.1.3 does not properly check the visibility of the content referenced by one of its shortcodes, allowing users with a role as low as Contributor to disclose the title and description of private, draft and other non-public posts.
Event History
Frequently Asked Questions
Which users can exploit this issue?
A user with the Contributor role can exploit it. The issue is therefore relevant where Contributors can create or submit content but should not be able to view private, draft, or other non-public download items.
What information can be disclosed?
The vulnerable shortcode can disclose the title and description of private, draft, and other non-public posts. The provided information does not indicate that the download files themselves or other post fields are exposed.
What component must be present for exploitation?
Exploitation involves the [sdm_show_download_info] shortcode. The affected plugin is Simple Download Monitor before version 4.1.3.
How can I determine whether my site is affected?
Check whether Simple Download Monitor is installed at a version earlier than 4.1.3 and whether Contributor-level users exist. Sites that use the [sdm_show_download_info] shortcode to reference non-public download items are exposed to the described disclosure.