Read the docs
TI-2022-02752 Aliases CVE-2022-2981GHSA-2739-p2pg-h53m

Download Monitor < 4.5.98 - Admin+ Arbitrary File Download

Priority LOW 25CWE-552Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-552.

Summary

The Download Monitor WordPress plugin before 4.5.98 does not ensure that files to be downloaded are inside the blog folders, and not sensitive, allowing high privilege users such as admin to download the wp-config.php or /etc/passwd even in an hardened environment or multisite setup.

Why it matters now

EPSS 0.01114 66th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed Download Monitor (Unknown): 4.5.98

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
UnknownDownload Monitor4.5.98 to before 4.5.984.5.98Patch availableCNA
  • Download Monitor VendorUnknown Affected 4.5.98 to before 4.5.98 Fixed in 4.5.98 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:wpchill:download_monitor:*:*:*:*:*:wordpress:*:*before 4.5.98Vulnerablewpchill
  • cpe:2.3:a:wpchill:download_monitor:*:*:*:*:*:wordpress:*:* Versions before 4.5.98 Vulnerable ·wpchill

Remediation

  • Fix · CNA Download Monitor (Unknown) Fixed in 4.5.98

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-2981
  2. 2026-10-03 Alias added: GHSA-2739-p2pg-h53m

References

Exploit 1

  • TI-2021-07068 Download Monitor < 4.4.5 - Admin+ SQL Injection CVSS 3.1HIGH 7.2
  • TI-2022-22320 WordPress Download Monitor Plugin <= 4.7.60 is vulnerable to Sensitive Data Exposure CVSS 3.1HIGH 7.5
  • TI-2021-05950 WordPress Download Monitor plugin <= 4.4.6 - Auth. Stored Cross-Site Scripting (XSS) vulnerability CVSS 3.1MEDIUM 4.8
  • TI-2023-16874 WordPress Download Monitor Plugin <= 4.8.3 is vulnerable to Arbitrary File Upload CVSS 3.1CRITICAL 9.9
  • TI-2022-04560 Download Monitor <= 4.7.51 - Missing Authorization to Unauthenticated Data Export CVSS 3.1HIGH 7.5
  • TI-2024-20225 WordPress Download Monitor theme <= 4.9.4 - Auth. SQL Injection vulnerability CVSS 3.1HIGH 7.6
See all 11 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences