What’s Vulnerable › Vulnerabilities

CVE-2021-24695: Simple Download Monitor < 3.9.6 - Unauthenticated Log Access

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.7% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2021-11-08 · updated 2026-06-17
• Weakness: CWE-425

Description

The Simple Download Monitor WordPress plugin before 3.9.6 saves logs in a predictable location, and does not have any authentication or authorisation in place to prevent unauthenticated users to download and read the logs containing Sensitive Information such as IP Addresses and Usernames

Affected products

• Simple Download Monitor: before 3.9.5 — fixed in 3.9.5

How to fix

Upgrade to a fixed version: Simple Download Monitor 3.9.5. Check the vendor advisory for mitigations.

References

• https://wpscan.com/vulnerability/d7bdaf2b-cdd9-4aee-b1bb-01728160ff25
• https://wpscan.com/vulnerability/d7bdaf2b-cdd9-4aee-b1bb-01728160ff25

Get alerted when CVE-2021-24695 or the next vulnerability affects your stack