What’s Vulnerable › Vulnerabilities

CVE-2021-24696: Simple Download Monitor < 3.9.9 - Multiple CSRF

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2022-01-24 · updated 2026-06-17
• Weakness: CWE-352

Description

The Simple Download Monitor WordPress plugin before 3.9.9 does not enforce nonce checks, which could allow attackers to perform CSRF attacks to 1) make admins export logs to exploit a separate log disclosure vulnerability (fixed in 3.9.6), 2) delete logs (fixed in 3.9.9), 3) remove thumbnail image from downloads

Affected products

• Simple Download Monitor: before 3.9.9 — fixed in 3.9.9

How to fix

Upgrade to a fixed version: Simple Download Monitor 3.9.9. Check the vendor advisory for mitigations.

References

• https://wpscan.com/vulnerability/e94772af-39ac-4743-a556-52351ebda9fe
• https://wpscan.com/vulnerability/e94772af-39ac-4743-a556-52351ebda9fe

Get alerted when CVE-2021-24696 or the next vulnerability affects your stack