CVE-2021-31567

Authenticated (admin+) Arbitrary File Download vulnerability discovered in Download Monitor WordPress plugin (versions <= 4.4.6). The plugin allows arbitrary files, including sensitive configuration files such as wp-config.php, to be downloaded via the &downloadable_file_urls[0] parameter data. It's also possible to escape from the web server home directory and download any file within the OS.

• CWE-200
• CWE-200

• https://github.com/WPChill/download-monitor/blob/master/changelog.txtRelease Notes, Third Party Advisory
• https://patchstack.com/database/vulnerability/download-monitor/wordpress-download-monitor-plugin-4-4-6-authenticated-arbitrary-file-download-vulnerabilityThird Party Advisory
• https://wordpress.org/plugins/download-monitor/#developersProduct
• https://github.com/WPChill/download-monitor/blob/master/changelog.txtRelease Notes, Third Party Advisory
• https://patchstack.com/database/vulnerability/download-monitor/wordpress-download-monitor-plugin-4-4-6-authenticated-arbitrary-file-download-vulnerabilityThird Party Advisory
• https://wordpress.org/plugins/download-monitor/#developersProduct

Published

Jan 28, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-31556An issue was discovered in the Oauth extension for MediaWiki…9.8
• CVE-2021-31558DIAEnergie Version 1.7.5 and prior is vulnerable to stored c…6.1
• CVE-2021-31559A crafted request bypasses S2S TCP Token authentication writ…7.5
• CVE-2021-3156Sudo before 1.9.5p2 contains an off-by-one error that can re…7.8
• CVE-2021-31562The SSL/TLS configuration of Fresenius Kabi Agilia Link + ve…9.1
• CVE-2021-31566An improper link resolution flaw can occur while extracting …7.8
• CVE-2021-31571The kernel in Amazon Web Services FreeRTOS before 10.4.3 has…9.8
• CVE-2021-31572The kernel in Amazon Web Services FreeRTOS before 10.4.3 has…9.8
• CVE-2021-31573In Config Manager, there is a possible command injection due…9.8
• CVE-2021-31574In Config Manager, there is a possible command injection due…9.8
• CVE-2021-31575In Config Manager, there is a possible command injection due…9.8
• CVE-2021-31576In Boa, there is a possible information disclosure due to a …7.5