Download Monitor < 4.4.5 - SQL Injection
CVE-2021-24786
Verified
Description
The Download Monitor plugin for WordPress is vulnerable to SQL injection via the 'orderby' parameter in versions before 4.4.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers with administrator-level permissions to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Severity
High
CVSS Score
7.2
Exploit Probability
17%
Affected Product
download_monitor
Published Date
November 2, 2025
Template Author
mrharsh
CVE-2021-24786.yaml
7.2Score
CVSS Metrics
CVSS Vector:
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVE ID:
cve-2021-24786
CWE ID:
cwe-89
Remediation Steps
Update to version 4.4.5 or later.