CVE-2026-109896

4.3Medium

Published 13 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash

4.3Medium

Attack vector: Network
Complexity: Low
Privileges needed: Low
User interaction: None
Impact: Limited impact
Weakness: CWE-862

Impact

Authenticated users with low privileges can read unauthorized download or order data over the network. They need a valid account on the WordPress site to exploit it.

Root cause

The plugin fails to perform authorization checks on restricted actions, allowing users with basic permissions to bypass access controls.

Affected systems

Download Monitor integration for WooCommerce through 1.0.3

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Fix & remediation

Upgrade the Download Monitor integration for WooCommerce plugin to a version newer than 1.0.3 if available, or deactivate the plugin until a patched release is published.

shell

$ wp plugin deactivate download-monitor-integration-for-woocommerce

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

Missing Authorization vulnerability in WP Chill Download Monitor integration for WooCommerce download-monitor-integration-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Download Monitor integration for WooCommerce: from n/a through 1.0.3.

References

https://patchstack.com/database/wordpress/plugin/download-monitor-integration-for-woocommerce/vulnerability/wordpress-download-monitor-integration-for-woocommerce-plugin-1-0-3-broken-access-control-vulnerability?_s_id=cve

Source: nvd.nist.gov/vuln/detail/CVE-2026-109896