Security Alert Summary
The Download Monitor plugin for WordPress contains an Insecure Direct Object Reference (IDOR) vulnerability in the executePayment() function. Missing validation on a user-controlled key can allow unauthenticated attackers to complete pending orders by reusing a payment token, enabling theft of paid digital goods.
CVE Details
- CVE ID: CVE-2026-3124
- Affected component: Download Monitor plugin for WordPress
- Affected versions: all versions up to, and including, 5.1.7
- Published: March 30, 2026 at 02:16:15 AM
- Last modified: March 30, 2026 at 01:26:07 PM
- CVSS v3.1: Base score 7.5, Severity: HIGH
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
- Authentication requirements: None required
- Privileges required: None
- User interaction: None
- Scope: Unchanged
- Primary impact: Confidentiality: NONE; Integrity: HIGH; Availability: NONE
- Weakness (CWE): CWE-639
Technical Details
The vulnerability is an Insecure Direct Object Reference stemming from missing validation on a user-controlled key in the plugin’s payment flow. The executePayment() function accepts a payment token that is expected to match a local pending order. Because the plugin does not properly validate that the provided PayPal transaction token corresponds to the specific local order, an attacker can supply a valid token obtained from a low-value purchase and use it to finalize a different, higher-value pending order.
In practice this allows unauthenticated attackers to complete arbitrary pending orders by exploiting the mismatch between the external PayPal transaction token and the plugin’s order record. The primary impact is integrity-related: attackers can cause orders to be completed without paying the intended amount for that order, resulting in loss of paid digital goods.
How This Could Impact Your Website
Consider a small e-commerce site using Download Monitor to sell digital downloads. A site owner lists items at multiple price points. An external attacker purchases a low-cost item and obtains a PayPal transaction token, then reuses that token to finalize another pending high-value order created by an internal staff member or an external contributor. The attacker completes the order flow and obtains access to digital goods intended for a paid customer, causing financial loss and customer service issues for the site.
Because the CVSS confidentiality impact is listed as NONE, the issue does not indicate direct exposure of stored confidential data such as user passwords or emails through this vulnerability alone; the primary risk is unauthorized completion of orders and theft of digital content. If you’re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review your setup.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles, especially contributor and shop manager roles that can create or modify orders.
- Enforce strong passwords and enable two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins to reduce attack surface.
- Monitor site activity and order logs for unusual behavior, including unexpected order completions or mismatched transaction tokens.
If you’d like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
