CVE-2026-112219 Download Monitor CVE debrief

Who should care

Network administrators and security teams responsible for WordPress installations, particularly those using the Download Monitor plugin in multisite environments, should assess exposure and prioritize remediation. This includes operators managing affected versions, vulnerability management teams, and security teams ensuring multisite installations are updated to version 5.3.5 or later.

Why it matters

This vulnerability in Download Monitor plugin allows unauthorized file serving, potentially leading to data exposure. Network administrators and security teams should assess exposure and prioritize remediation for multisite installations of affected versions.

• Potential unauthorized file disclosure to unauthenticated visitors
• Elevation of privileges for subsite administrators
• Possible data exposure or leakage

Technical summary

The Download Monitor WordPress plugin before 5.3.5 does not correctly restrict management of the list of filesystem locations it may serve files from to network administrators on multisite, allowing a subsite administrator who is not trusted at the network level to approve arbitrary locations and have the Download Monitor WordPress plugin before 5.3.5 serve readable files from outside the uploads directory, including files belonging to other subsites, to unauthenticated visitors; single-site installations are unaffected.

Defensive priority

Assess exposure and prioritize remediation for multisite installations of Download Monitor versions prior to 5.3.5.

Recommended defensive actions

• Assess exposure of Download Monitor installations to this vulnerability
• Prioritize remediation for multisite installations of affected versions
• Verify version 5.3.5 or later is installed
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and source item provide details on the vulnerability in Download Monitor versions prior to 5.3.5. Limited information is available on potential exploitation or impact. Network administrators and security teams should verify version 5.3.5 or later is installed and assess exposure. The vulnerability allows unauthorized file serving, potentially leading to data exposure. Evidence from the CVE Program and source item suggests multisite installations are affected.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.