Simple Download Monitor < 3.9.6 - Unauthenticated Log Access
3Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackepss 1.6%
exploitation probability
1.6%top 26% of all CVEs
observed exploitation
nono source reports it
In short
The Simple Download Monitor plugin saves download logs in an easy-to-guess location without requiring login. Anyone on the internet can access these logs and see sensitive information like IP addresses and usernames.
Technical detail
CWE-425 (Direct Request): The plugin stores logs in a predictable directory without authentication checks, allowing unauthenticated users to directly access and download files containing IP addresses and usernames. No pre-authentication is required; the attacker needs only knowledge of the log file location.
Summary generated and translated by AI from the official description.
The Simple Download Monitor WordPress plugin before 3.9.6 saves logs in a predictable location, and does not have any authentication or authorisation in place to prevent unauthenticated users to download and read the logs containing Sensitive Information such as IP Addresses and Usernames
Affected products
Unknown · Simple Download Monitor