PatchTheCVECVE-2021-24696: The Simple Download Monitor WordPress plugin before 3.9.9 does not enforce nonce checks, which could allow att
CVE-2021-24696 is a high-severity flaw (CVSS 8.8) affecting simple download monitor. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
The Simple Download Monitor WordPress plugin before 3.9.9 does not enforce nonce checks, which could allow attackers to perform CSRF attacks to 1) make admins export logs to exploit a separate log disclosure vulnerability (fixed in 3.9.6), 2) delete logs (fixed in 3.9.9), 3) remove thumbnail image from downloads
Why this priority
- High severity
- Public exploit reference
A fixed release or distro patch exists.
Risk facts
| CVSS score | 8.8 (High) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | None |
| User interaction | Required |
| EPSS exploit chance | 0.6% (top 50%) |
| CISA exploited list | No |
| Weakness | CWE-352 |
| Published | 2022-01-24 |
| Last modified | 2026-06-17 |
Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2021-24696?
simple download monitor: upgrade to 3.9.9. Exact commands for each OS are on this page.
Is CVE-2021-24696 being exploited?
CVE-2021-24696 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2021-24696 affect?
CVE-2021-24696 affects simple download monitor. Severity is high (CVSS 8.8). The Simple Download Monitor WordPress plugin before 3.9.9 does not enforce nonce checks, which could allow attackers to perform CSRF attacks to 1) make admins export logs to exploit a separate log disclosure vulnerability (fixed in 3.9.6),
How urgent is CVE-2021-24696?
Priority 48/100. High severity; Public exploit reference
Software pages
Related CVEs
- CVE-2021-24698 MEDIUM 4.3 UPGRADE The Simple Download Monitor WordPress plugin before 3.9.6 allows users with a role as low as Contributor to re
- CVE-2021-24697 MEDIUM 6.1 UPGRADE The Simple Download Monitor WordPress plugin before 3.9.5 does not escape the 1) sdm_active_tab GET parameter
- CVE-2021-24695 HIGH 7.5 UPGRADE The Simple Download Monitor WordPress plugin before 3.9.6 saves logs in a predictable location, and does not h
- CVE-2021-24694 MEDIUM 5.4 UPGRADE The Simple Download Monitor WordPress plugin before 3.9.11 could allow users with a role as low as Contributor
- CVE-2021-24693 CRITICAL 9.0 UPGRADE The Simple Download Monitor WordPress plugin before 3.9.5 does not escape the "File Thumbnail" post meta befor