PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-39489 WP Chill CVE debrief

CVE-2026-39489 is a medium-severity vulnerability (CVSS Score: 4.4) affecting the Download Monitor plugin for WordPress, specifically versions up to 5.1.9. The issue allows an author to download arbitrary files. The vulnerability was published on [cvePublishedAt] and last modified on [cveModifiedAt].

Vendor
WP Chill
Product
Download Monitor
CVSS
MEDIUM 4.4
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-15
Original CVE updated
2026-06-15
Advisory published
2026-06-15
Advisory updated
2026-06-15

Who should care

Users of the Download Monitor plugin for WordPress, particularly those with authors who have access to the plugin's functionality, should be aware of this vulnerability.

Technical summary

The vulnerability is characterized as CWE-22, which relates to Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'). The CVSS vector for this vulnerability is CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N.

Defensive priority

This vulnerability is considered medium severity and requires attention, especially if the plugin is used in an environment where authors have significant access.

Recommended defensive actions

  • Update the Download Monitor plugin to a version beyond 5.1.9 if available.
  • Restrict access to the plugin's functionality to trusted users only.
  • Monitor for any suspicious activity related to file downloads.

Evidence notes

Evidence for this CVE comes from Patchstack, as noted in the source item.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-39489 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-39489

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-39489 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-39489

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.