Security readout for executives and security teams
Plain-English summary
CVE-2021-24786 affects the Download Monitor WordPress plugin before 4.4.5. An authenticated administrator viewing logs could influence an SQL query through the orderby request parameter. This can threaten database confidentiality, integrity, and availability, but the available sources indicate high privileges are required.
Executive priority
Treat as high priority where Download Monitor is installed and administrator accounts are shared, weakly protected, or exposed to phishing risk. The required privilege level reduces broad internet exposure but does not remove database-impact risk after admin compromise.
Technical view
The plugin failed to properly validate and escape the orderby GET parameter before using it in SQL on the logs view. The issue is CWE-89 SQL injection with CVSS 3.1 score 7.2 and vector AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H.
Likely exposure
Exposure is limited to WordPress sites running Download Monitor versions before 4.4.5, especially where many users have administrator-level access. The source bundle does not identify affected CPEs or non-WordPress products.
Exploitation context
The source bundle does not cite active exploitation, and KEV status is false. The vulnerability requires high privileges, so the primary concern is abuse by a compromised or malicious administrator-level account rather than direct unauthenticated attack.
Researcher notes
Evidence supports an admin-level SQL injection in the logs view through orderby handling. Sources do not provide exploit code, proof of active exploitation, or detailed patch internals. Validate exposure through version checks and defensive log review only.
Mitigation direction
- Upgrade Download Monitor to version 4.4.5 or later.
- Confirm vendor or WPScan guidance for any additional remediation.
- Restrict administrator access to trusted accounts only.
- Review privileged WordPress accounts for compromise or unnecessary access.
Validation and detection
- Inventory WordPress sites using the Download Monitor plugin.
- Confirm installed plugin versions are 4.4.5 or later.
- Review administrator-level account activity around Download Monitor log views.
- Check application logs for unusual requests involving the logs orderby parameter.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-89: Database access and collection lookup
Injection into data stores can inform collection, data access, and exfiltration detection reviews. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupDatabase behavior lookup
The CVE wording references database injection or access, so collection and exfiltration review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2021-24786 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.2 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H1.25.9Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
7.2HighVector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Source materials
- CVE List V5 sourceCVE List V5
- https://wpscan.com/vulnerability/a6571f16-66d2-449e-af83-1c6ddd56edfaCVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.