CVE-2022-2222: vulnerability in Download Monitor
Download Monitor < 4.5.91 - Admin+ Arbitrary File Download
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
3Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackepss 1.1%
The Download Monitor WordPress plugin before 4.5.91 does not ensure that files to be downloaded are inside the blog folders, and not sensitive, allowing high privilege users such as admin to download the wp-config.php or /etc/passwd even in an hardened environment or multisite setup.
Affected products
Unknown · Download MonitorRelated CVEs — Download Monitor
In the same product, most dangerous first.
CVE-2021-24786HIGHDownload Monitor < 4.4.5 - Admin+ SQL InjectionEPSS 17.3%CVE-2022-2981—Download Monitor < 4.5.98 - Admin+ Arbitrary File DownloadEPSS 1.1%CVE-2026-112219MEDIUMDownload Monitor < 5.3.5 - Multisite Subsite Admin+ Incorrect Authorization via Approved Download Paths REST RouteEPSS 0.3%CVE-2026-16608MEDIUMDownload Monitor < 5.2.6 - Unauthenticated Download Log InjectionEPSS 0.3%CVE-2026-112207HIGHDownload Monitor < 5.3.4 - Reflected XSS via Cross-Origin Download LinkEPSS 0.2%