CVE-2026-118637 · Package
NO FIX YET · SEE WHAT TO DO
The Simple Download Monitor WordPress plugin before 4.1.3 fails to check visibility of content referenced by one of its shortcodes. A logged-in user with a Contributor role can read the title and description of private, draft and other non-public posts.
first public Nov 4, 2026 · 1 source
Is this in your stack? Find out in 2 minutes.
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Sites running the Simple Download Monitor WordPress plugin before 4.1.3 where logged-in users with the Contributor role or higher can use its shortcodes. The exposure is limited to titles and descriptions of non-public posts, not full content. Sites without the plugin, or with it at 4.1.3 or later, can skip it.
Not affected if no-contributor-accounts, plugin-at-4.1.3-or-later
Who cares simple-download-monitor, wordpress
4.1.3 are affected.4.1.3 or later (per the advisory's 'before 4.1.3' range).The Simple Download Monitor WordPress plugin before 4.1.3 does not properly check the visibility of the content referenced by one of its shortcodes, allowing users with a role as low as Contributor to disclose the title and description of private, draft and other non-public posts.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.