Published October 24, 2026. Based on public CVE records available on that date; details may change.

Two CVEs published on October 23 and 24, 2026 affect the Download Monitor WordPress plugin: a reflected cross-site scripting (XSS) issue fixed in version 5.3.4, and a multisite authorization flaw fixed in version 5.3.5. Any site running a version before 5.3.4 is exposed to the first issue, and multisite networks running a version before 5.3.5 are exposed to the second. Update Download Monitor to 5.3.5 or later, which covers both.

What happened

Both issues were reported by Karthik Ramakrishnan and coordinated through WPScan, which assigned the CVEs. Download Monitor has 80,000+ active installations on WordPress.org as of October 24, 2026. The plugin's changelog lists version 5.3.4 (October 9, 2026) and version 5.3.5 (October 20, 2026) as security updates.

CVE-2026-112207 (titled "Reflected XSS via Cross-Origin Download Link"): according to the record, the plugin does not properly check that a clicked link belongs to the site before fetching it in the browser and rendering part of the response in the page. That allows an unauthenticated attacker to run JavaScript in the browser of any user who is tricked into clicking a crafted link. Versions before 5.3.4 are affected.

CVE-2026-112219 (titled "Multisite Subsite Admin+ Incorrect Authorization via Approved Download Paths REST Route"): Download Monitor keeps a list of filesystem locations it is allowed to serve files from. On multisite, managing that list should be limited to network administrators. The record says versions before 5.3.5 do not enforce that restriction, so a subsite administrator who is not trusted at the network level can approve arbitrary locations. The plugin can then serve readable files from outside the uploads directory, including files belonging to other subsites, to unauthenticated visitors. The record states that single-site installations are unaffected.

Severity and exploitation status

The CVE records from WPScan do not include their own CVSS score. The scores in the records come from CISA's enrichment (the CISA ADP container), and NVD displays the same CISA scores:

  • CVE-2026-112207: 7.1 (high), CVSS 3.1. No privileges required, user interaction required.
  • CVE-2026-112219: 4.9 (medium), CVSS 3.1. High privileges required, no user interaction, high confidentiality impact.

NVD had not published its own assessment for either CVE when this article was written. NVD lists CVE-2026-112207 as received and CVE-2026-112219 as deferred.

CISA's assessment in both records lists exploitation as "none" and automatable as "no". Neither record reports exploitation in the wild, and neither CVE appeared in CISA's Known Exploited Vulnerabilities data on NVD at the time of writing.

Who is affected

The two CVEs have different conditions, so check both.

  • CVE-2026-112207: any site running Download Monitor before 5.3.4. No account is needed to attempt it, but the attack depends on a user clicking a crafted link. The users who matter most are logged-in administrators and editors, since JavaScript running in their browser session can act with their permissions.
  • CVE-2026-112219: only WordPress multisite networks running Download Monitor before 5.3.5, and only where someone holds a subsite administrator account. The risk is highest on networks where subsite administrators are clients, partners, or other people who are not trusted with network-level access. The impact is file disclosure: readable files outside the uploads directory, including other subsites' files, can be served to anyone.

Sites already on 5.3.4 are covered for CVE-2026-112207 but, on multisite, still need 5.3.5 for CVE-2026-112219.

How to check your site

Start by confirming the installed version.

  1. In the WordPress admin, open Plugins and find Download Monitor. Note the version number. On multisite, check from Network Admin > Plugins.
  2. With WP-CLI, run wp plugin get download-monitor --field=version from the WordPress directory.
  3. Run wp plugin list --name=download-monitor to see the status and version together.
  4. To confirm whether the install is multisite, run wp eval 'echo is_multisite() ? "multisite" : "single";' or look for a Network Admin link in the admin toolbar.
  5. Repeat for staging and development copies, which often lag behind production.

If the version is lower than 5.3.5, update. If it is also lower than 5.3.4, both issues apply on multisite and CVE-2026-112207 applies on any site.

On multisite, also review who holds administrator roles on each subsite. wp site list --fields=blog_id,url lists the subsites, and wp user list --role=administrator --url= followed by a subsite URL shows that subsite's administrators. Anyone on that list you do not recognize deserves a closer look.

What to do now

The fix is to update Download Monitor to 5.3.5 or later. Use Dashboard > Updates, the Plugins screen (or Network Admin > Plugins on multisite), or wp plugin update download-monitor. Check that downloads still work afterward, since the 5.3.x releases also changed how file paths and protected files are handled.

If you cannot update right away:

  • Tell administrators and editors not to click unexpected links to your site that arrive by email, chat, or comments, especially links that look like download links.
  • On multisite, if your version lists approved download locations in the plugin's settings, review them on each subsite and remove anything outside the uploads directory you did not add.
  • Reduce the number of subsite administrator accounts to people you trust, and downgrade the rest until the update is done.

After updating, check for signs that either issue was used. For CVE-2026-112207, look for new administrator accounts or settings changes nobody made, using our guide to finding hidden WordPress admin users. For CVE-2026-112219, review web server access logs for download requests serving files that are not part of your normal downloads. If anything looks wrong, follow how to fix a hacked WordPress site. Keeping plugins current and limiting administrator roles are both part of the WordPress hardening checklist.

When to get help

Get help if you find administrator accounts nobody recognizes, approved download locations you did not add, or file downloads in your logs that should not exist. WordPress malware removal is the right starting point for a suspected compromise, and a security audit can review your multisite roles and plugin settings together.

Sources