CVE-2026-112219— Download Monitor < 5.3.5 - Multisite Subsite Admin+ Incorrect Authorization via Approved Download Paths REST Route
Quick assessment
Affected
Unknown Download Monitor
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 5.3.5 版本之前的 Download Monitor WordPress 插件中，未能正确限制多站点（Multisite）环境下对“插件可从中提供文件的文件系统位置列表”的管理权限，仅应允许网络管理员（Network Administrator）进行此类操作。该缺陷使得未被网络层面信任的子站点管理员（Subsite Administrator）能够批准任意文件位置，导致插件向未认证的访客提供位于上传目录（uploads directory）之外的可读文件，包括属于其他子站点的文件。单站点安装（Single-
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-112219
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Download Monitor < 5.3.5 - Multisite Subsite Admin+ Incorrect Authorization via Approved Download Paths REST Route
Source: CVE Program / CVE List V5
Vulnerability Description
The Download Monitor WordPress plugin before 5.3.5 does not correctly restrict management of the list of filesystem locations it may serve files from to network administrators on multisite, allowing a subsite administrator who is not trusted at the network level to approve arbitrary locations and have the Download Monitor WordPress plugin before 5.3.5 serve readable files from outside the uploads directory, including files belonging to other subsites, to unauthenticated visitors; single-site installations are unaffected.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Unknown | Download Monitor | 0 ~ 5.3.5 | - |
|
II. Public POCs for CVE-2026-112219
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-112219
请登录查看更多情报信息。
Other References for CVE-2026-112219 (1)
-
https://wpscan.com/vulnerability/fa0d1250-6408-4645-9033-b6a9a16d3e67/ exploit vdb-entry technical-description
Same Patch Batch · Unknown · 2026-10-23 · 20 CVEs total
| CVE-2026-111982 | Profile Builder < 4.0.5 - Multisite Subsite Admin+ Network Super Admin Account Takeover vi | |
| CVE-2026-110537 | Essential Addons for Elementor < 6.8.7 - Admin+ Cross-Site User Approval State Change via | |
| CVE-2026-110510 | Essential Addons for Elementor < 6.8.7 - Author+ Content Injection via Pricing Table and P | |
| CVE-2026-109935 | Otter Blocks < 3.2.8 - Unauthenticated Restricted Block Content Disclosure via REST API | |
| CVE-2026-109933 | Otter Blocks < 3.2.8 - Contributor+ Stored XSS via Block Style Attributes | |
| CVE-2026-109934 | Otter Blocks 3.1.1 - 3.2.7 - Unauthenticated Non-Public Content Disclosure via REST API | |
| CVE-2026-109936 | Otter Blocks < 3.2.8 - Unauthenticated Stored XSS via Dynamic Content Render Filter | |
| CVE-2026-111737 | Speed Optimizer < 7.8.5 - Admin+ Stored XSS via DNS Prefetch and Font Preload URL Lists | |
| CVE-2026-111738 | Speed Optimizer < 7.8.5 - Admin+ Network Option Update via enable-option/disable-option | |
| CVE-2026-111966 | Profile Builder < 4.0.5 - Contributor+ Stored XSS via redirect_url Shortcode Attribute | |
| CVE-2026-94268 | Advanced Custom Fields: Extended 0.9.2.7 - Unauthenticated Administrator Account Takeover | |
| CVE-2026-113472 | Depicter 4.0.5 - 4.8.1 - Editor+ Arbitrary File Upload via Media Upload | |
| CVE-2026-113501 | LiteSpeed Cache < 7.9.2 - Subscriber+ Pinned Administrative Notice Dismissal | |
| CVE-2026-113500 | LiteSpeed Cache < 7.9.2 - Unauthenticated Stored XSS via Font Display Optimization | |
| CVE-2026-113499 | LiteSpeed Cache < 7.9.2 - Unauthenticated Stored XSS via CDN Inline CSS Rewriting | |
| CVE-2026-112230 | Popup Builder < 4.4.6 - Unauthenticated Popup Trashing via post_type Parameter | |
| CVE-2026-94267 | Advanced Custom Fields: Extended < 0.9.2.8 - Unauthenticated RCE via Front-End Post Update | |
| CVE-2026-94264 | Advanced Custom Fields: Extended 0.8.9.4 - 0.9.2.7 - Contributor+ XSS via Form Shortcode A | |
| CVE-2026-94262 | Advanced Custom Fields: Extended 0.9.2.7 - Unauthenticated Non-Administrator Account Takeo |
IV. Related Vulnerabilities
Same product: Download Monitor
-
CVE-2026-110375
WordPress Download Monitor plugin <= 5.3.3 - Cross Site Scri -
CVE-2026-100182
Download Monitor <= 5.2.10 - Unauthenticated Stored Cross-Si -
CVE-2026-16608
Download Monitor < 5.2.6 - Unauthenticated Download Log Inje -
CVE-2026-39489
WordPress Download Monitor plugin <= 5.1.9 - Non-Arbitrary F -
CVE-2026-39486
WordPress Download Monitor plugin <= 5.1.8 - SQL Injection v
Same vendor: Unknown
-
CVE-2026-94268
Advanced Custom Fields: Extended 0.9.2.7 - Unauthenticated A -
CVE-2026-94262
Advanced Custom Fields: Extended 0.9.2.7 - Unauthenticated N -
CVE-2026-94264
Advanced Custom Fields: Extended 0.8.9.4 - 0.9.2.7 - Contrib -
CVE-2026-94267
Advanced Custom Fields: Extended < 0.9.2.8 - Unauthenticated -
CVE-2026-112230
Popup Builder < 4.4.6 - Unauthenticated Popup Trashing via p
V. Comments for CVE-2026-112219
No comments yet