CVE-2021-24786: Download Monitor < 4.4.5 - Admin+ SQL Injection

Severity: high (CVSS 7.2 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 17.3% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2022-01-03 · updated 2026-06-17
Weakness: CWE-89

Description

The Download Monitor WordPress plugin before 4.4.5 does not properly validate and escape the "orderby" GET parameter before using it in a SQL statement when viewing the logs, leading to an SQL Injection issue

Affected products

wpchill Download Monitor: before 4.4.5 — fixed in 4.4.5

How to fix

Upgrade to a fixed version: wpchill Download Monitor 4.4.5. Check the vendor advisory for mitigations.

References

https://wpscan.com/vulnerability/a6571f16-66d2-449e-af83-1c6ddd56edfa
https://wpscan.com/vulnerability/a6571f16-66d2-449e-af83-1c6ddd56edfa

Get alerted when CVE-2021-24786 or the next vulnerability affects your stack