Read the docs
TI-2021-06977 Aliases CVE-2021-24695GHSA-vh6h-77mp-jg82

Simple Download Monitor < 3.9.6 - Unauthenticated Log Access

Priority LOW 36CWE-425Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-425.

Summary

The Simple Download Monitor WordPress plugin before 3.9.6 saves logs in a predictable location, and does not have any authentication or authorisation in place to prevent unauthenticated users to download and read the logs containing Sensitive Information such as IP Addresses and Usernames

Why it matters now

EPSS 0.01679 77th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed Simple Download Monitor (Unknown): 3.9.6

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
UnknownSimple Download Monitor3.9.6 to before 3.9.63.9.6Patch availableCNA
  • Simple Download Monitor VendorUnknown Affected 3.9.6 to before 3.9.6 Fixed in 3.9.6 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:tipsandtricks-hq:simple_download_monitor:*:*:*:*:*:wordpress:*:*before 3.9.5Vulnerablemra13
  • cpe:2.3:a:tipsandtricks-hq:simple_download_monitor:*:*:*:*:*:wordpress:*:* Versions before 3.9.5 Vulnerable ·mra13

Remediation

  • Fix · CNA Simple Download Monitor (Unknown) Fixed in 3.9.6

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Simple Download Monitor 3.9.6

    2 records Highest priority Priority LOW 2 LOW

    Other records, highest priority first

    • TI-2021-06980 Simple Download Monitor < 3.9.6 - Arbitrary Thumbnails RemovalPriority LOW 21
    Show all 2 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-24695
  2. 2026-10-03 Alias added: GHSA-vh6h-77mp-jg82

References

Exploit 1

  • TI-2021-06975 Simple Download Monitor < 3.9.5 - Contributor+ Stored Cross-Site Scripting via File Thumbnail CVSS 3.1CRITICAL 9.0
  • TI-2020-04618 SQL injection in Tips and Tricks HQ Simple Download Monitor CVSS 3.1HIGH 8.8
  • TI-2021-06978 Simple Download Monitor < 3.9.9 - Multiple CSRF CVSS 3.1HIGH 8.8
  • TI-2021-06974 Simple Download Monitor < 3.9.5 - Contributor+ Arbitrary File Download via Path Traversal CVSS 3.1MEDIUM 6.5
  • TI-2021-06979 Simple Download Monitor < 3.9.5 - Reflected Cross-Site Scripting CVSS 3.1MEDIUM 6.1
  • TI-2020-04617 Cross-site scripting in Tips and Tricks HQ Simple Download Monitor CVSS 3.1MEDIUM 6.1
See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences