CVE-2026-3124 - Download Monitor <= 5.1.7 - Insecure Direct Object Reference to Unauthenticated Arbitrary Order Completion via 'token' and 'order_id'

Back Back to CVE browser

HIGH

Download Monitor <= 5.1.7 - Insecure Direct Object Reference to Unauthenticated Arbitrary Order Completion via 'token' and 'order_id'

Published Mar 30, 2026

7.5

HIGH

CVSS 3.1

EPSS 0.36%

Description

The Download Monitor plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.1.7 via the executePayment() function due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to complete arbitrary pending orders by exploiting a mismatch between the PayPal transaction token and the local order, allowing theft of paid digital goods by paying a minimal amount for a low-cost item and using that payment token to finalize a high-value order.

Affected products

Vendor Wpchill Product Download Monitor Default
unaffected
- Version
  0
  Status
  affected
  Constraints
  <=5.1.7

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Wpchill

Download Monitor

unaffected

Version	Status	Constraints
0	affected	<=5.1.7

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-639

Authorization Bypass

References (2)

Link	Providers	Tags
https://plugins.trac.wordpress.org/changeset/3470119/download-monitor
https://www.wordfence.com/threat-intel/vulnerabilities/id/45527d6c-6866-44e6-85c2-5be984afbbc9?source=cve