CVE-2022-2981: The Download Monitor WordPress plugin before 4.5.98 does not ensure that files to be downloaded are inside the blog folders, and not sensitive, allowing high privilege users such as admin to download

medium Affects download-monitor (WordPress plugin). Feed 2026.10.29.1, updated 2026-10-28; published 2022-10-10; advisory modified 2026-06-17.

The Download Monitor WordPress plugin before 4.5.98 does not ensure that files to be downloaded are inside the blog folders, and not sensitive, allowing high privilege users such as admin to download

Package: download-monitor (WordPress plugin) WordPress
Affected versions: <4.5.98
Fixed in: 4.5.98
Severity: medium CVSS 4.9
Exploitation: not on CISA KEV · EPSS 1% (65.9th percentile)
Published: 2022-10-10
Source: nvd

References

CWE-552

NVD record download-monitor (WordPress plugin) advisories

Am I affected?

Find out in one command. phpwarden checks your WordPress install against this advisory and 20,000+ others, ranked by real-world exploitation (CISA KEV + EPSS). Free, offline, open data.

# PHP projects (recommended)
composer require --dev phpwarden/phpwarden
# then
vendor/bin/phpwarden wordpress /var/www/html

# or, without Composer
pipx install phpwarden   &&   phpwarden wordpress /var/www/html

Or keep it checked automatically with the GitHub Action or a nightly cron; see WordPress docs.

Install docs How findings are ranked

Related advisories

CVE-2021-23174 low Authenticated (admin+) Persistent Cross-Site Scripting (XSS) vulnerability discovered in D same package: download-monitor (WordPress plugin)
CVE-2021-24786 high The Download Monitor WordPress plugin before 4.4.5 does not properly validate and escape t same package: download-monitor (WordPress plugin)
CVE-2012-4768 medium Cross-site scripting (XSS) vulnerability in the Download Monitor plugin before 3.3.5.9 for same package: download-monitor (WordPress plugin)
CVE-2013-3262 medium Cross-site scripting (XSS) vulnerability in admin/admin.php in the Download Monitor plugin same package: download-monitor (WordPress plugin)
CVE-2013-5098 medium Cross-site scripting (XSS) vulnerability in admin/admin.php in the Download Monitor plugin same package: download-monitor (WordPress plugin)
CVE-2021-31567 medium Authenticated (admin+) Arbitrary File Download vulnerability discovered in Download Monito same package: download-monitor (WordPress plugin)