CVE-2021-24698: Simple Download Monitor < 3.9.6 - Arbitrary Thumbnails Removal

Severity: medium (CVSS 4.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.7% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2021-11-08 · updated 2026-06-17
Weakness: CWE-284

Description

The Simple Download Monitor WordPress plugin before 3.9.6 allows users with a role as low as Contributor to remove thumbnails from downloads they do not own, even if they cannot normally edit the download.

Affected products

Simple Download Monitor: before 3.9.6 — fixed in 3.9.6

How to fix

Upgrade to a fixed version: Simple Download Monitor 3.9.6. Check the vendor advisory for mitigations.

References

https://wpscan.com/vulnerability/1fda1356-77d8-4e77-9ee6-8f9ceeb3d380
https://wpscan.com/vulnerability/1fda1356-77d8-4e77-9ee6-8f9ceeb3d380

Get alerted when CVE-2021-24698 or the next vulnerability affects your stack