CVE-2026-112219
Last modified
CVE-2026-112219 is a medium-severity vulnerability rated 4.9/10 on the CVSS scale. The Download Monitor WordPress plugin before 5.3.5 does not correctly restrict management of the list of filesystem locations it may serve files from to network administrators on multisite, allowing a subsite administrator who is not trusted at the network level to approve arbitrary locations and have the Download Monitor WordPress plugin before 5.3.5 serve readable files from outside the uploads directory, including files belonging to other subsites, to unauthenticated visitors; single-site installations are unaffected..
Description
The Download Monitor WordPress plugin before 5.3.5 does not correctly restrict management of the list of filesystem locations it may serve files from to network administrators on multisite, allowing a subsite administrator who is not trusted at the network level to approve arbitrary locations and have the Download Monitor WordPress plugin before 5.3.5 serve readable files from outside the uploads directory, including files belonging to other subsites, to unauthenticated visitors; single-site installations are unaffected.
Metrics
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| Unknown | Download Monitor | < 5.3.5 |
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2026-112219?
How severe is CVE-2026-112219?
How do I fix CVE-2026-112219?
How Strix Helps
- Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-11221Insufficient validation of untrusted input in PointerLock in…4.3
- CVE-2026-112210A flaw was found in the rhc-canonical-facts.service systemd …6
- CVE-2026-112211Rejected reason: This CVE ID has been rejected or withdrawn …
- CVE-2026-112212GitLab has remediated an issue in GitLab CE/EE affecting all…7.5
- CVE-2026-112214A flaw was found in the GStreamer ASF demuxer in gst-plugins…6.5
- CVE-2026-112218Missing Authorization vulnerability in Ahmad Majestic Suppor…5.3
- CVE-2026-11222Incorrect security UI in Tab Strip in Google Chrome prior to…6.5
- CVE-2026-112221Improper Neutralization of Input During Web Page Generation …7.1
- CVE-2026-112222Missing Authorization vulnerability in Surfer Surfer surfers…5.4
- CVE-2026-11223Insufficient validation of untrusted input in Network in Goo…6.5
- CVE-2026-112230The Popup Builder WordPress plugin before 4.4.6 does not pe…3.7
- CVE-2026-112237The extension provides a public proxy endpoint that fetches …6.9
Are you affected by CVE-2026-112219?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST