CVE-2026-4401: 
WordPress vulnerability analysis and mitigation

CVE-2026-4401 is a Cross-Site Request Forgery (CSRF) vulnerability in the Download Monitor plugin for WordPress, affecting all versions up to and including 5.1.10. The flaw exists in the actions_handler() and bulk_actions_handler() methods within class-dlm-downloads-path.php due to missing nonce verification. It was published on April 8, 2026, and assigned a CVSS v3.1 base score of 5.4 (Medium) (GitHub Advisory). The vulnerability was discovered and reported by Wordfence (GitHub Advisory).

The root cause is CWE-352 (Cross-Site Request Forgery), specifically the absence of WordPress nonce verification in the actions_handler() and bulk_actions_handler() methods of class-dlm-downloads-path.php (lines ~L427 and ~L495). Because these functions do not validate that incoming requests originate from an authenticated, intentional administrator action, an attacker can craft a malicious HTTP request that, when triggered by a logged-in administrator (e.g., via a deceptive link or embedded iframe), performs unauthorized state-changing operations on download path configurations. No special privileges or authentication are required on the attacker's side; the only precondition is that a site administrator must be tricked into interacting with attacker-controlled content (GitHub Advisory).

Successful exploitation allows an unauthenticated attacker to delete, disable, or enable approved download paths on the affected WordPress site, impacting both integrity and availability of the plugin's file distribution functionality. There is no confidentiality impact, as the vulnerability does not expose sensitive data. The disruption of download path configurations could break legitimate file distribution workflows and allow unauthorized modifications to download settings (GitHub Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of publication (GitHub Advisory). The EPSS score is approximately 0.02% (0.000200), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported.

1. Reconnaissance: Identify WordPress sites running the Download Monitor plugin at version 5.1.10 or earlier using tools like WPScan or by inspecting publicly accessible plugin metadata (e.g., readme.txt).
2. Craft malicious request: Construct an HTTP request targeting the vulnerable actions_handler() or bulk_actions_handler() endpoint in the plugin's admin interface (e.g., a form or URL that triggers a delete, disable, or enable action on a download path).
3. Social engineering: Embed the malicious request in a webpage, email, or other medium (e.g., as an auto-submitting HTML form or an <img> tag with the crafted URL) and deliver it to a site administrator who is currently authenticated to the WordPress dashboard.
4. Trigger action: When the administrator visits or interacts with the attacker-controlled content, their browser automatically sends the forged request with their session credentials, causing the plugin to execute the unauthorized action (delete, disable, or enable download paths) without nonce validation (GitHub Advisory).

• Logs: WordPress admin action logs or server access logs showing unexpected POST requests to admin-ajax.php or plugin-specific admin endpoints for download path management, originating from unusual referrers or external domains.
• Application State: Unexpected changes to approved download paths in the Download Monitor plugin settings (paths deleted, disabled, or enabled without administrator intent).
• Network: HTTP requests to WordPress admin endpoints for download path actions arriving from external or unexpected referrer URLs, particularly with no valid nonce parameter.

Upgrade the Download Monitor plugin to version 5.1.11 or later, which implements proper nonce verification in the affected methods (GitHub Advisory). The patch can be reviewed in the plugin's changeset between tags 5.1.10 and 5.1.11. As additional hardening measures, configure SameSite=Strict or SameSite=Lax cookie attributes, deploy a Web Application Firewall (WAF) capable of detecting CSRF patterns, and train administrators to avoid clicking unsolicited links while logged into the WordPress dashboard.