TI-2021-06980 Aliases CVE-2021-24698 GHSA-j66f-pwrh-8rh3

Simple Download Monitor < 3.9.6 - Arbitrary Thumbnails Removal

LOW 21CWE-284Published 2021-11-08 · Updated 2024-08-03

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: Security bypass
Confidentiality · integrity · availability: None · Low · None
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-284.

Summary

The Simple Download Monitor WordPress plugin before 3.9.6 allows users with a role as low as Contributor to remove thumbnails from downloads they do not own, even if they cannot normally edit the download.

Why it matters now

EPSS 0.00675 52nd percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Fixed Simple Download Monitor (Unknown): 3.9.6

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Unknown	Simple Download Monitor	3.9.6 to before 3.9.6	3.9.6	Patch available	CNA

Simple Download Monitor VendorUnknown Affected 3.9.6 to before 3.9.6 Fixed in 3.9.6 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:tipsandtricks-hq:simple_download_monitor::::::wordpress::*	before 3.9.6	Vulnerable	mra13

cpe:2.3:a:tipsandtricks-hq:simple_download_monitor:*:*:*:*:*:wordpress:*:* Versions before 3.9.6 Vulnerable ·mra13

Remediation

Fix · CNA Simple Download Monitor (Unknown) Fixed in 3.9.6

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Release · 2021-11-08
Simple Download Monitor 3.9.6
2 records Highest priority Priority LOW 2 LOW
Other records, highest priority first
- TI-2021-06977 Simple Download Monitor < 3.9.6 - Unauthenticated Log AccessPriority LOW 36
Show all 2 records →

Timeline

2026-10-02 Threatist record created from CVE-2021-24698
2026-10-03 Alias added: GHSA-j66f-pwrh-8rh3

References

Exploit 1

https://wpscan.com/vulnerability/1fda1356-77d8-4e77-9ee6-8f9ceeb3d380

TI-2021-06975 Simple Download Monitor < 3.9.5 - Contributor+ Stored Cross-Site Scripting via File Thumbnail CVSS 3.1CRITICAL 9.0
TI-2020-04618 SQL injection in Tips and Tricks HQ Simple Download Monitor CVSS 3.1HIGH 8.8
TI-2021-06978 Simple Download Monitor < 3.9.9 - Multiple CSRF CVSS 3.1HIGH 8.8
TI-2021-06977 Simple Download Monitor < 3.9.6 - Unauthenticated Log Access CVSS 3.1HIGH 7.5
TI-2021-06974 Simple Download Monitor < 3.9.5 - Contributor+ Arbitrary File Download via Path Traversal CVSS 3.1MEDIUM 6.5
TI-2021-06979 Simple Download Monitor < 3.9.5 - Reflected Cross-Site Scripting CVSS 3.1MEDIUM 6.1

See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences