PatchTheCVECVE-2021-24695: The Simple Download Monitor WordPress plugin before 3.9.6 saves logs in a predictable location, and does not h
CVE-2021-24695 is a high-severity flaw (CVSS 7.5) affecting simple download monitor. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
The Simple Download Monitor WordPress plugin before 3.9.6 saves logs in a predictable location, and does not have any authentication or authorisation in place to prevent unauthenticated users to download and read the logs containing Sensitive Information such as IP Addresses and Usernames
Why this priority
- High severity
- Public exploit reference
- Remotely exploitable, no login, no user action
A fixed release or distro patch exists.
Risk facts
| CVSS score | 7.5 (High) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | None |
| User interaction | None |
| EPSS exploit chance | 1.7% (top 23%) |
| CISA exploited list | No |
| Weakness | CWE-425 |
| Published | 2021-11-08 |
| Last modified | 2026-06-17 |
Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2021-24695?
simple download monitor: upgrade to 3.9.5. Exact commands for each OS are on this page.
Is CVE-2021-24695 being exploited?
CVE-2021-24695 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2021-24695 affect?
CVE-2021-24695 affects simple download monitor. Severity is high (CVSS 7.5). The Simple Download Monitor WordPress plugin before 3.9.6 saves logs in a predictable location, and does not have any authentication or authorisation in place to prevent unauthenticated users to download and read the logs containing Sensiti
How urgent is CVE-2021-24695?
Priority 55/100. High severity; Public exploit reference; Remotely exploitable, no login, no user action
Software pages
Related CVEs
- CVE-2021-24698 MEDIUM 4.3 UPGRADE The Simple Download Monitor WordPress plugin before 3.9.6 allows users with a role as low as Contributor to re
- CVE-2021-24697 MEDIUM 6.1 UPGRADE The Simple Download Monitor WordPress plugin before 3.9.5 does not escape the 1) sdm_active_tab GET parameter
- CVE-2021-24696 HIGH 8.8 UPGRADE The Simple Download Monitor WordPress plugin before 3.9.9 does not enforce nonce checks, which could allow att
- CVE-2021-24694 MEDIUM 5.4 UPGRADE The Simple Download Monitor WordPress plugin before 3.9.11 could allow users with a role as low as Contributor
- CVE-2021-24693 CRITICAL 9.0 UPGRADE The Simple Download Monitor WordPress plugin before 3.9.5 does not escape the "File Thumbnail" post meta befor