CVE-2026-39486

The Download Monitor plugin for WordPress contains a vulnerability that allows attackers to inject malicious SQL code into the application's database. This occurs because the plugin does not properly sanitize user input, allowing attackers to modify existing SQL queries and potentially extract sensitive information. The vulnerability affects versions up to and including 5.1.8, and an attacker must have contributor-level access or higher to exploit it.

Based on public CVE data (MITRE/NVD).